From 1444580ae3464dd0a15736b221e747b7816b3a9a Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Mon, 18 Mar 2024 18:55:57 -0400 Subject: [PATCH] Fixes for 6.1 Signed-off-by: Sasha Levin --- ...-alc285-reduce-pop-noise-from-headph.patch | 35 ++++ ...-fix-dtc-interrupt_provider-warnings.patch | 168 ++++++++++++++++++ ...the-maximum-allocation-for-the-sve-p.patch | 99 +++++++++++ ...ra-set-the-correct-phy-mode-for-mgbe.patch | 35 ++++ ...lenovo-thinkbook-21j0-into-dmi-quirk.patch | 42 +++++ ...ix-non-functional-mic-on-lenovo-21j2.patch | 41 +++++ ...ix-non-functional-mic-on-lenovo-82uu.patch | 44 +++++ ..._rt5640-add-an-extra-entry-for-the-c.patch | 52 ++++++ ...-lattepanda-board-dmi-match-more-pre.patch | 63 +++++++ ...le-both-spkoutr_ena-and-spkoutl_ena-.patch | 76 ++++++++ ...le-oscillator-if-selecting-wm8962_fl.patch | 37 ++++ ...up-incorrect-error-message-in-wm8962.patch | 36 ++++ ...andle-empty-atoms-when-parsing-respo.patch | 65 +++++++ ...fix-limited-discoverable-off-timeout.patch | 51 ++++++ ...-fix-null-ptr-deref-in-rfcomm_check_.patch | 58 ++++++ ...ace-at-btrfs_use_block_rsv-when-acce.patch | 104 +++++++++++ ...aces-when-accessing-the-reserved-amo.patch | 164 +++++++++++++++++ ...ypt-align-struct-bvec_iter-correctly.patch | 71 ++++++++ ...e-gpu-reset-for-s3-abort-cases-on-ra.patch | 90 ++++++++++ ...se-long-bus-reset-on-gap-count-error.patch | 65 +++++++ ...ands-fix-invalid-escape-sequence-war.patch | 36 ++++ ...dd-required-quirk-for-synaptics-0xcd.patch | 40 +++++ ...polled-suppress-deferred-probe-error.patch | 55 ++++++ ...-irq-handling-due-to-shared-interrup.patch | 140 +++++++++++++++ ...-cause.bd-in-instruction_pointer_set.patch | 39 ++++ ...-allocation-size-of-iucv_path_table-.patch | 46 +++++ ...d-support-for-sys-tec-usb-spemodule1.patch | 40 +++++ ...d-missing-config_dynamic_ftrace-chec.patch | 42 +++++ ...karound-ampereonex-errata-ac04_mesh_.patch | 54 ++++++ ...rtify-source-warning-while-accessing.patch | 131 ++++++++++++++ ...lax-devx-access-upon-modify-commands.patch | 47 +++++ ...-add-missing-interrupt-cells-to-pmic.patch | 36 ++++ ...vent-sending-diag_reset-when-the-con.patch | 44 +++++ ...use-exact-comparison-in-recv_partial.patch | 44 +++++ queue-6.1/series | 39 ++++ ...x-polarfire_soc_sys_ctrl-input-promp.patch | 33 ++++ ...ly-call-drv_sta_rc_update-for-upload.patch | 39 ++++ ...vsyscall-page-read-for-copy_from_ker.patch | 100 +++++++++++ ...s_vsyscall_vaddr-into-asm-vsyscall.h.patch | 71 ++++++++ ...-some-null-pointer-checking-to-smp.c.patch | 79 ++++++++ 40 files changed, 2551 insertions(+) create mode 100644 queue-6.1/alsa-hda-realtek-alc285-reduce-pop-noise-from-headph.patch create mode 100644 queue-6.1/arm64-dts-fix-dtc-interrupt_provider-warnings.patch create mode 100644 queue-6.1/arm64-sve-lower-the-maximum-allocation-for-the-sve-p.patch create mode 100644 queue-6.1/arm64-tegra-set-the-correct-phy-mode-for-mgbe.patch create mode 100644 queue-6.1/asoc-amd-yc-add-lenovo-thinkbook-21j0-into-dmi-quirk.patch create mode 100644 queue-6.1/asoc-amd-yc-fix-non-functional-mic-on-lenovo-21j2.patch create mode 100644 queue-6.1/asoc-amd-yc-fix-non-functional-mic-on-lenovo-82uu.patch create mode 100644 queue-6.1/asoc-intel-bytcr_rt5640-add-an-extra-entry-for-the-c.patch create mode 100644 queue-6.1/asoc-rt5645-make-lattepanda-board-dmi-match-more-pre.patch create mode 100644 queue-6.1/asoc-wm8962-enable-both-spkoutr_ena-and-spkoutl_ena-.patch create mode 100644 queue-6.1/asoc-wm8962-enable-oscillator-if-selecting-wm8962_fl.patch create mode 100644 queue-6.1/asoc-wm8962-fix-up-incorrect-error-message-in-wm8962.patch create mode 100644 queue-6.1/block-sed-opal-handle-empty-atoms-when-parsing-respo.patch create mode 100644 queue-6.1/bluetooth-mgmt-fix-limited-discoverable-off-timeout.patch create mode 100644 queue-6.1/bluetooth-rfcomm-fix-null-ptr-deref-in-rfcomm_check_.patch create mode 100644 queue-6.1/btrfs-fix-data-race-at-btrfs_use_block_rsv-when-acce.patch create mode 100644 queue-6.1/btrfs-fix-data-races-when-accessing-the-reserved-amo.patch create mode 100644 queue-6.1/dm-verity-dm-crypt-align-struct-bvec_iter-correctly.patch create mode 100644 queue-6.1/drm-amdgpu-enable-gpu-reset-for-s3-abort-cases-on-ra.patch create mode 100644 queue-6.1/firewire-core-use-long-bus-reset-on-gap-count-error.patch create mode 100644 queue-6.1/gen_compile_commands-fix-invalid-escape-sequence-war.patch create mode 100644 queue-6.1/hid-multitouch-add-required-quirk-for-synaptics-0xcd.patch create mode 100644 queue-6.1/input-gpio_keys_polled-suppress-deferred-probe-error.patch create mode 100644 queue-6.1/media-rkisp1-fix-irq-handling-due-to-shared-interrup.patch create mode 100644 queue-6.1/mips-clear-cause.bd-in-instruction_pointer_set.patch create mode 100644 queue-6.1/net-iucv-fix-the-allocation-size-of-iucv_path_table-.patch create mode 100644 queue-6.1/net-smsc95xx-add-support-for-sys-tec-usb-spemodule1.patch create mode 100644 queue-6.1/parisc-ftrace-add-missing-config_dynamic_ftrace-chec.patch create mode 100644 queue-6.1/perf-arm-cmn-workaround-ampereonex-errata-ac04_mesh_.patch create mode 100644 queue-6.1/rdma-mlx5-fix-fortify-source-warning-while-accessing.patch create mode 100644 queue-6.1/rdma-mlx5-relax-devx-access-upon-modify-commands.patch create mode 100644 queue-6.1/riscv-dts-sifive-add-missing-interrupt-cells-to-pmic.patch create mode 100644 queue-6.1/scsi-mpt3sas-prevent-sending-diag_reset-when-the-con.patch create mode 100644 queue-6.1/selftests-tls-use-exact-comparison-in-recv_partial.patch create mode 100644 queue-6.1/soc-microchip-fix-polarfire_soc_sys_ctrl-input-promp.patch create mode 100644 queue-6.1/wifi-mac80211-only-call-drv_sta_rc_update-for-upload.patch create mode 100644 queue-6.1/x86-mm-disallow-vsyscall-page-read-for-copy_from_ker.patch create mode 100644 queue-6.1/x86-mm-move-is_vsyscall_vaddr-into-asm-vsyscall.h.patch create mode 100644 queue-6.1/x86-xen-add-some-null-pointer-checking-to-smp.c.patch diff --git a/queue-6.1/alsa-hda-realtek-alc285-reduce-pop-noise-from-headph.patch b/queue-6.1/alsa-hda-realtek-alc285-reduce-pop-noise-from-headph.patch new file mode 100644 index 00000000000..a78423434ef --- /dev/null +++ b/queue-6.1/alsa-hda-realtek-alc285-reduce-pop-noise-from-headph.patch @@ -0,0 +1,35 @@ +From 3700e88445abed8017e82c4a1dc3da5546711926 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 14:54:34 +0800 +Subject: ALSA: hda/realtek - ALC285 reduce pop noise from Headphone port + +From: Kailang Yang + +[ Upstream commit b34bf65838f7c6e785f62681605a538b73c2808c ] + +It had pop noise from Headphone port when system reboot state. +If NID 58h Index 0x0 to fill default value, it will reduce pop noise. + +Signed-off-by: Kailang Yang +Link: https://lore.kernel.org/r/7493e207919a4fb3a0599324fd010e3e@realtek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 75bd7b2fa4ee6..ede3f8b273d79 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3681,6 +3681,7 @@ static void alc285_hp_init(struct hda_codec *codec) + int i, val; + int coef38, coef0d, coef36; + ++ alc_write_coefex_idx(codec, 0x58, 0x00, 0x1888); /* write default value */ + alc_update_coef_idx(codec, 0x4a, 1<<15, 1<<15); /* Reset HP JD */ + coef38 = alc_read_coef_idx(codec, 0x38); /* Amp control */ + coef0d = alc_read_coef_idx(codec, 0x0d); /* Digital Misc control */ +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-fix-dtc-interrupt_provider-warnings.patch b/queue-6.1/arm64-dts-fix-dtc-interrupt_provider-warnings.patch new file mode 100644 index 00000000000..8667282c3d9 --- /dev/null +++ b/queue-6.1/arm64-dts-fix-dtc-interrupt_provider-warnings.patch @@ -0,0 +1,168 @@ +From 5c30838f4260548426c3dfeeebdf58fb100d6076 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 13:34:27 -0600 +Subject: arm64: dts: Fix dtc interrupt_provider warnings + +From: Rob Herring + +[ Upstream commit 91adecf911e5df78ea3e8f866e69db2c33416a5c ] + +The dtc interrupt_provider warning is off by default. Fix all the warnings +so it can be enabled. + +Signed-off-by: Rob Herring +Reviewed-By: AngeloGioacchino Del Regno # +Reviewed-by: Geert Uytterhoeven +Acked-by: Geert Uytterhoeven +Acked-by: Florian Fainelli #Broadcom +Acked-by: Chanho Min +Link: https://lore.kernel.org/r/20240213-arm-dt-cleanups-v1-3-f2dee1292525@kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amazon/alpine-v2.dtsi | 1 - + arch/arm64/boot/dts/amazon/alpine-v3.dtsi | 1 - + arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi | 1 + + arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi | 1 + + arch/arm64/boot/dts/lg/lg1312.dtsi | 1 - + arch/arm64/boot/dts/lg/lg1313.dtsi | 1 - + arch/arm64/boot/dts/marvell/armada-ap80x.dtsi | 1 - + arch/arm64/boot/dts/mediatek/mt8195-demo.dts | 1 + + arch/arm64/boot/dts/renesas/ulcb-kf.dtsi | 4 ++++ + 9 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/amazon/alpine-v2.dtsi b/arch/arm64/boot/dts/amazon/alpine-v2.dtsi +index 4eb2cd14e00b0..9b6da84deae7a 100644 +--- a/arch/arm64/boot/dts/amazon/alpine-v2.dtsi ++++ b/arch/arm64/boot/dts/amazon/alpine-v2.dtsi +@@ -145,7 +145,6 @@ pci@fbc00000 { + msix: msix@fbe00000 { + compatible = "al,alpine-msix"; + reg = <0x0 0xfbe00000 0x0 0x100000>; +- interrupt-controller; + msi-controller; + al,msi-base-spi = <160>; + al,msi-num-spis = <160>; +diff --git a/arch/arm64/boot/dts/amazon/alpine-v3.dtsi b/arch/arm64/boot/dts/amazon/alpine-v3.dtsi +index 73a352ea8fd5c..b30014d4dc29c 100644 +--- a/arch/arm64/boot/dts/amazon/alpine-v3.dtsi ++++ b/arch/arm64/boot/dts/amazon/alpine-v3.dtsi +@@ -351,7 +351,6 @@ pcie@fbd00000 { + msix: msix@fbe00000 { + compatible = "al,alpine-msix"; + reg = <0x0 0xfbe00000 0x0 0x100000>; +- interrupt-controller; + msi-controller; + al,msi-base-spi = <336>; + al,msi-num-spis = <959>; +diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi +index fda97c47f4e97..d5778417455c0 100644 +--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi ++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi +@@ -584,6 +584,7 @@ gpio_g: gpio@660a0000 { + #gpio-cells = <2>; + gpio-controller; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupts = ; + }; + +diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi +index 8f8c25e51194d..473d7d0ddf369 100644 +--- a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi ++++ b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi +@@ -442,6 +442,7 @@ gpio_hsls: gpio@d0000 { + #gpio-cells = <2>; + gpio-controller; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupts = ; + gpio-ranges = <&pinmux 0 0 16>, + <&pinmux 16 71 2>, +diff --git a/arch/arm64/boot/dts/lg/lg1312.dtsi b/arch/arm64/boot/dts/lg/lg1312.dtsi +index 78ae73d0cf365..98ff17b14b2a5 100644 +--- a/arch/arm64/boot/dts/lg/lg1312.dtsi ++++ b/arch/arm64/boot/dts/lg/lg1312.dtsi +@@ -124,7 +124,6 @@ eth0: ethernet@c1b00000 { + amba { + #address-cells = <2>; + #size-cells = <1>; +- #interrupt-cells = <3>; + + compatible = "simple-bus"; + interrupt-parent = <&gic>; +diff --git a/arch/arm64/boot/dts/lg/lg1313.dtsi b/arch/arm64/boot/dts/lg/lg1313.dtsi +index 2173316573bee..8e9410d8f46c0 100644 +--- a/arch/arm64/boot/dts/lg/lg1313.dtsi ++++ b/arch/arm64/boot/dts/lg/lg1313.dtsi +@@ -124,7 +124,6 @@ eth0: ethernet@c3700000 { + amba { + #address-cells = <2>; + #size-cells = <1>; +- #interrupt-cells = <3>; + + compatible = "simple-bus"; + interrupt-parent = <&gic>; +diff --git a/arch/arm64/boot/dts/marvell/armada-ap80x.dtsi b/arch/arm64/boot/dts/marvell/armada-ap80x.dtsi +index a06a0a889c43f..73d8803b54d8b 100644 +--- a/arch/arm64/boot/dts/marvell/armada-ap80x.dtsi ++++ b/arch/arm64/boot/dts/marvell/armada-ap80x.dtsi +@@ -133,7 +133,6 @@ pmu { + + odmi: odmi@300000 { + compatible = "marvell,odmi-controller"; +- interrupt-controller; + msi-controller; + marvell,odmi-frames = <4>; + reg = <0x300000 0x4000>, +diff --git a/arch/arm64/boot/dts/mediatek/mt8195-demo.dts b/arch/arm64/boot/dts/mediatek/mt8195-demo.dts +index 5117b2e7985af..998c2e78168a6 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195-demo.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8195-demo.dts +@@ -111,6 +111,7 @@ mt6360: pmic@34 { + compatible = "mediatek,mt6360"; + reg = <0x34>; + interrupt-controller; ++ #interrupt-cells = <1>; + interrupts-extended = <&pio 101 IRQ_TYPE_EDGE_FALLING>; + interrupt-names = "IRQB"; + +diff --git a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi +index 588b14b66b6fb..f37abfc13fe59 100644 +--- a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi ++++ b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi +@@ -251,6 +251,7 @@ gpio_exp_74: gpio@74 { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupt-parent = <&gpio6>; + interrupts = <8 IRQ_TYPE_EDGE_FALLING>; + +@@ -311,6 +312,7 @@ gpio_exp_75: gpio@75 { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupt-parent = <&gpio6>; + interrupts = <4 IRQ_TYPE_EDGE_FALLING>; + }; +@@ -331,6 +333,7 @@ gpio_exp_76: gpio@76 { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupt-parent = <&gpio7>; + interrupts = <3 IRQ_TYPE_EDGE_FALLING>; + }; +@@ -341,6 +344,7 @@ gpio_exp_77: gpio@77 { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupt-parent = <&gpio5>; + interrupts = <9 IRQ_TYPE_EDGE_FALLING>; + }; +-- +2.43.0 + diff --git a/queue-6.1/arm64-sve-lower-the-maximum-allocation-for-the-sve-p.patch b/queue-6.1/arm64-sve-lower-the-maximum-allocation-for-the-sve-p.patch new file mode 100644 index 00000000000..9d84d3d057f --- /dev/null +++ b/queue-6.1/arm64-sve-lower-the-maximum-allocation-for-the-sve-p.patch @@ -0,0 +1,99 @@ +From b268d7c77632880430f85c53834aa517c79b027f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 18:24:38 +0000 +Subject: arm64/sve: Lower the maximum allocation for the SVE ptrace regset + +From: Mark Brown + +[ Upstream commit 2813926261e436d33bc74486b51cce60b76edf78 ] + +Doug Anderson observed that ChromeOS crashes are being reported which +include failing allocations of order 7 during core dumps due to ptrace +allocating storage for regsets: + + chrome: page allocation failure: order:7, + mode:0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), + nodemask=(null),cpuset=urgent,mems_allowed=0 + ... + regset_get_alloc+0x1c/0x28 + elf_core_dump+0x3d8/0xd8c + do_coredump+0xeb8/0x1378 + +with further investigation showing that this is: + + [ 66.957385] DOUG: Allocating 279584 bytes + +which is the maximum size of the SVE regset. As Doug observes it is not +entirely surprising that such a large allocation of contiguous memory might +fail on a long running system. + +The SVE regset is currently sized to hold SVE registers with a VQ of +SVE_VQ_MAX which is 512, substantially more than the architectural maximum +of 16 which we might see even in a system emulating the limits of the +architecture. Since we don't expose the size we tell the regset core +externally let's define ARCH_SVE_VQ_MAX with the actual architectural +maximum and use that for the regset, we'll still overallocate most of the +time but much less so which will be helpful even if the core is fixed to +not require contiguous allocations. + +Specify ARCH_SVE_VQ_MAX in terms of the maximum value that can be written +into ZCR_ELx.LEN (where this is set in the hardware). For consistency +update the maximum SME vector length to be specified in the same style +while we are at it. + +We could also teach the ptrace core about runtime discoverable regset sizes +but that would be a more invasive change and this is being observed in +practical systems. + +Reported-by: Doug Anderson +Signed-off-by: Mark Brown +Tested-by: Douglas Anderson +Link: https://lore.kernel.org/r/20240213-arm64-sve-ptrace-regset-size-v2-1-c7600ca74b9b@kernel.org +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/fpsimd.h | 12 ++++++------ + arch/arm64/kernel/ptrace.c | 3 ++- + 2 files changed, 8 insertions(+), 7 deletions(-) + +diff --git a/arch/arm64/include/asm/fpsimd.h b/arch/arm64/include/asm/fpsimd.h +index da18413712c04..930b0e6c94622 100644 +--- a/arch/arm64/include/asm/fpsimd.h ++++ b/arch/arm64/include/asm/fpsimd.h +@@ -36,13 +36,13 @@ + * When we defined the maximum SVE vector length we defined the ABI so + * that the maximum vector length included all the reserved for future + * expansion bits in ZCR rather than those just currently defined by +- * the architecture. While SME follows a similar pattern the fact that +- * it includes a square matrix means that any allocations that attempt +- * to cover the maximum potential vector length (such as happen with +- * the regset used for ptrace) end up being extremely large. Define +- * the much lower actual limit for use in such situations. ++ * the architecture. Using this length to allocate worst size buffers ++ * results in excessively large allocations, and this effect is even ++ * more pronounced for SME due to ZA. Define more suitable VLs for ++ * these situations. + */ +-#define SME_VQ_MAX 16 ++#define ARCH_SVE_VQ_MAX ((ZCR_ELx_LEN_MASK >> ZCR_ELx_LEN_SHIFT) + 1) ++#define SME_VQ_MAX ((SMCR_ELx_LEN_MASK >> SMCR_ELx_LEN_SHIFT) + 1) + + struct task_struct; + +diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c +index e1f6366b7ccdf..d02dd2be17b3b 100644 +--- a/arch/arm64/kernel/ptrace.c ++++ b/arch/arm64/kernel/ptrace.c +@@ -1450,7 +1450,8 @@ static const struct user_regset aarch64_regsets[] = { + #ifdef CONFIG_ARM64_SVE + [REGSET_SVE] = { /* Scalable Vector Extension */ + .core_note_type = NT_ARM_SVE, +- .n = DIV_ROUND_UP(SVE_PT_SIZE(SVE_VQ_MAX, SVE_PT_REGS_SVE), ++ .n = DIV_ROUND_UP(SVE_PT_SIZE(ARCH_SVE_VQ_MAX, ++ SVE_PT_REGS_SVE), + SVE_VQ_BYTES), + .size = SVE_VQ_BYTES, + .align = SVE_VQ_BYTES, +-- +2.43.0 + diff --git a/queue-6.1/arm64-tegra-set-the-correct-phy-mode-for-mgbe.patch b/queue-6.1/arm64-tegra-set-the-correct-phy-mode-for-mgbe.patch new file mode 100644 index 00000000000..0825a3e94f8 --- /dev/null +++ b/queue-6.1/arm64-tegra-set-the-correct-phy-mode-for-mgbe.patch @@ -0,0 +1,35 @@ +From 7611dcdbdd689088442b71cfea6f0347b66647b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 11:08:12 +0100 +Subject: arm64: tegra: Set the correct PHY mode for MGBE + +From: Thierry Reding + +[ Upstream commit 4c892121d43bc2b45896ca207b54f39a8fa6b852 ] + +The PHY is configured in 10GBASE-R, so make sure to reflect that in DT. + +Reviewed-by: Jon Hunter +Tested-by: Jon Hunter +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts b/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts +index f094011be9ed9..8099dc04ed2e1 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts ++++ b/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts +@@ -2024,7 +2024,7 @@ ethernet@6800000 { + status = "okay"; + + phy-handle = <&mgbe0_phy>; +- phy-mode = "usxgmii"; ++ phy-mode = "10gbase-r"; + + mdio { + #address-cells = <1>; +-- +2.43.0 + diff --git a/queue-6.1/asoc-amd-yc-add-lenovo-thinkbook-21j0-into-dmi-quirk.patch b/queue-6.1/asoc-amd-yc-add-lenovo-thinkbook-21j0-into-dmi-quirk.patch new file mode 100644 index 00000000000..f64105caf02 --- /dev/null +++ b/queue-6.1/asoc-amd-yc-add-lenovo-thinkbook-21j0-into-dmi-quirk.patch @@ -0,0 +1,42 @@ +From 7b9a09792abb2b7cf56dbc0708beae001172a159 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Feb 2024 21:44:50 +0800 +Subject: ASoC: amd: yc: Add Lenovo ThinkBook 21J0 into DMI quirk table + +From: Johnny Hsieh + +[ Upstream commit 50ee641643dd0f46702e9a99354398196e1734c2 ] + +This patch adds Lenovo 21J0 (ThinkBook 16 G5+ ARP) to the DMI quirks table +to enable internal microphone array. + +Cc: linux-sound@vger.kernel.org +Signed-off-by: Johnny Hsieh +Link: https://msgid.link/r/TYSPR04MB8429D62DFDB6727866ECF1DEC55A2@TYSPR04MB8429.apcprd04.prod.outlook.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 5921af7fd92c5..0568e64d10150 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -199,6 +199,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "21HY"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21J0"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.43.0 + diff --git a/queue-6.1/asoc-amd-yc-fix-non-functional-mic-on-lenovo-21j2.patch b/queue-6.1/asoc-amd-yc-fix-non-functional-mic-on-lenovo-21j2.patch new file mode 100644 index 00000000000..ba37b1300cd --- /dev/null +++ b/queue-6.1/asoc-amd-yc-fix-non-functional-mic-on-lenovo-21j2.patch @@ -0,0 +1,41 @@ +From 9a11358ad960075adbc96cf78e041b926025d59b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 15:39:14 +0800 +Subject: ASoC: amd: yc: Fix non-functional mic on Lenovo 21J2 + +From: Jiawei Wang + +[ Upstream commit ed00a6945dc32462c2d3744a3518d2316da66fcc ] + +Like many other models, the Lenovo 21J2 (ThinkBook 16 G5+ APO) +needs a quirk entry for the internal microphone to function. + +Signed-off-by: Jiawei Wang +Link: https://msgid.link/r/20240228073914.232204-2-me@jwang.link +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 0568e64d10150..e0f406b6646ba 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -199,6 +199,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "21HY"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21J2"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.43.0 + diff --git a/queue-6.1/asoc-amd-yc-fix-non-functional-mic-on-lenovo-82uu.patch b/queue-6.1/asoc-amd-yc-fix-non-functional-mic-on-lenovo-82uu.patch new file mode 100644 index 00000000000..49ed4f32ccf --- /dev/null +++ b/queue-6.1/asoc-amd-yc-fix-non-functional-mic-on-lenovo-82uu.patch @@ -0,0 +1,44 @@ +From cfeb4335220d99c1dec168598aebd49fc5ddc982 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Feb 2024 21:36:38 +0200 +Subject: ASoC: amd: yc: Fix non-functional mic on Lenovo 82UU +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Attila Tőkés + +[ Upstream commit f7fe85b229bc30cb5dc95b4e9015a601c9e3a8cd ] + +Like many other models, the Lenovo 82UU (Yoga Slim 7 Pro 14ARH7) +needs a quirk entry for the internal microphone to function. + +Signed-off-by: Attila Tőkés +Link: https://msgid.link/r/20240210193638.144028-1-attitokes@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 28da4e1858d7e..5921af7fd92c5 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -227,6 +227,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "82QF"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "82UU"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.43.0 + diff --git a/queue-6.1/asoc-intel-bytcr_rt5640-add-an-extra-entry-for-the-c.patch b/queue-6.1/asoc-intel-bytcr_rt5640-add-an-extra-entry-for-the-c.patch new file mode 100644 index 00000000000..90d527eb66f --- /dev/null +++ b/queue-6.1/asoc-intel-bytcr_rt5640-add-an-extra-entry-for-the-c.patch @@ -0,0 +1,52 @@ +From d3c0ff58b5b4b497c15292c52da917857c9e849c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 19:28:41 +0000 +Subject: ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 + tablet +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alban Boyé + +[ Upstream commit f8b0127aca8c60826e7354e504a12d4a46b1c3bb ] + +The bios version can differ depending if it is a dual-boot variant of the tablet. +Therefore another DMI match is required. + +Signed-off-by: Alban Boyé +Reviewed-by: Cezary Rojewski +Acked-by: Pierre-Louis Bossart +Link: https://msgid.link/r/20240228192807.15130-1-alban.boye@protonmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 797d0a48d6066..094445036c20f 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -685,6 +685,18 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, ++ { /* Chuwi Vi8 dual-boot (CWI506) */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Insyde"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "i86"), ++ /* The above are too generic, also match BIOS info */ ++ DMI_MATCH(DMI_BIOS_VERSION, "CHUWI2.D86JHBNR02"), ++ }, ++ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | ++ BYT_RT5640_MONO_SPEAKER | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { + /* Chuwi Vi10 (CWI505) */ + .matches = { +-- +2.43.0 + diff --git a/queue-6.1/asoc-rt5645-make-lattepanda-board-dmi-match-more-pre.patch b/queue-6.1/asoc-rt5645-make-lattepanda-board-dmi-match-more-pre.patch new file mode 100644 index 00000000000..6efad872589 --- /dev/null +++ b/queue-6.1/asoc-rt5645-make-lattepanda-board-dmi-match-more-pre.patch @@ -0,0 +1,63 @@ +From a6857ef72f730340005a9ae3ee20589bd3ca4e8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Feb 2024 22:27:35 +0100 +Subject: ASoC: rt5645: Make LattePanda board DMI match more precise + +From: Hans de Goede + +[ Upstream commit 551539a8606e28cb2a130f8ef3e9834235b456c4 ] + +The DMI strings used for the LattePanda board DMI quirks are very generic. + +Using the dmidecode database from https://linux-hardware.org/ shows +that the chosen DMI strings also match the following 2 laptops +which also have a rt5645 codec: + +Insignia NS-P11W7100 https://linux-hardware.org/?computer=E092FFF8BA04 +Insignia NS-P10W8100 https://linux-hardware.org/?computer=AFB6C0BF7934 + +All 4 hw revisions of the LattePanda board have "S70CR" in their BIOS +version DMI strings: + +DF-BI-7-S70CR100-* +DF-BI-7-S70CR110-* +DF-BI-7-S70CR200-* +LP-BS-7-S70CR700-* + +See e.g. https://linux-hardware.org/?computer=D98250A817C0 + +Add a partial (non exact) DMI match on this string to make the LattePanda +board DMI match more precise to avoid false-positive matches. + +Signed-off-by: Hans de Goede +Link: https://msgid.link/r/20240211212736.179605-1-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5645.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c +index 844d14d4c9a51..aac9140749968 100644 +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -3802,6 +3802,16 @@ static const struct dmi_system_id dmi_platform_data[] = { + DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"), + DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"), + DMI_EXACT_MATCH(DMI_BOARD_VERSION, "Default string"), ++ /* ++ * Above strings are too generic, LattePanda BIOS versions for ++ * all 4 hw revisions are: ++ * DF-BI-7-S70CR100-* ++ * DF-BI-7-S70CR110-* ++ * DF-BI-7-S70CR200-* ++ * LP-BS-7-S70CR700-* ++ * Do a partial match for S70CR to avoid false positive matches. ++ */ ++ DMI_MATCH(DMI_BIOS_VERSION, "S70CR"), + }, + .driver_data = (void *)&lattepanda_board_platform_data, + }, +-- +2.43.0 + diff --git a/queue-6.1/asoc-wm8962-enable-both-spkoutr_ena-and-spkoutl_ena-.patch b/queue-6.1/asoc-wm8962-enable-both-spkoutr_ena-and-spkoutl_ena-.patch new file mode 100644 index 00000000000..a7ccef421fd --- /dev/null +++ b/queue-6.1/asoc-wm8962-enable-both-spkoutr_ena-and-spkoutl_ena-.patch @@ -0,0 +1,76 @@ +From 0be3f22836c9cd20e16fd9c57e78d6511d9b40e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 16:14:36 +0000 +Subject: ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode + +From: Stuart Henderson + +[ Upstream commit 6fa849e4d78b880e878138bf238e4fd2bac3c4fa ] + +Signed-off-by: Stuart Henderson +Link: https://msgid.link/r/20240306161439.1385643-2-stuarth@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 23 ++++++++++++++--------- + 1 file changed, 14 insertions(+), 9 deletions(-) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index 35d8cd4fc71a7..806b69c9b2e36 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -2229,6 +2229,9 @@ SND_SOC_DAPM_PGA_E("HPOUT", SND_SOC_NOPM, 0, 0, NULL, 0, hp_event, + + SND_SOC_DAPM_OUTPUT("HPOUTL"), + SND_SOC_DAPM_OUTPUT("HPOUTR"), ++ ++SND_SOC_DAPM_PGA("SPKOUTL Output", WM8962_CLASS_D_CONTROL_1, 6, 0, NULL, 0), ++SND_SOC_DAPM_PGA("SPKOUTR Output", WM8962_CLASS_D_CONTROL_1, 7, 0, NULL, 0), + }; + + static const struct snd_soc_dapm_widget wm8962_dapm_spk_mono_widgets[] = { +@@ -2236,7 +2239,6 @@ SND_SOC_DAPM_MIXER("Speaker Mixer", WM8962_MIXER_ENABLES, 1, 0, + spkmixl, ARRAY_SIZE(spkmixl)), + SND_SOC_DAPM_MUX_E("Speaker PGA", WM8962_PWR_MGMT_2, 4, 0, &spkoutl_mux, + out_pga_event, SND_SOC_DAPM_POST_PMU), +-SND_SOC_DAPM_PGA("Speaker Output", WM8962_CLASS_D_CONTROL_1, 7, 0, NULL, 0), + SND_SOC_DAPM_OUTPUT("SPKOUT"), + }; + +@@ -2251,9 +2253,6 @@ SND_SOC_DAPM_MUX_E("SPKOUTL PGA", WM8962_PWR_MGMT_2, 4, 0, &spkoutl_mux, + SND_SOC_DAPM_MUX_E("SPKOUTR PGA", WM8962_PWR_MGMT_2, 3, 0, &spkoutr_mux, + out_pga_event, SND_SOC_DAPM_POST_PMU), + +-SND_SOC_DAPM_PGA("SPKOUTR Output", WM8962_CLASS_D_CONTROL_1, 7, 0, NULL, 0), +-SND_SOC_DAPM_PGA("SPKOUTL Output", WM8962_CLASS_D_CONTROL_1, 6, 0, NULL, 0), +- + SND_SOC_DAPM_OUTPUT("SPKOUTL"), + SND_SOC_DAPM_OUTPUT("SPKOUTR"), + }; +@@ -2366,12 +2365,18 @@ static const struct snd_soc_dapm_route wm8962_spk_mono_intercon[] = { + { "Speaker PGA", "Mixer", "Speaker Mixer" }, + { "Speaker PGA", "DAC", "DACL" }, + +- { "Speaker Output", NULL, "Speaker PGA" }, +- { "Speaker Output", NULL, "SYSCLK" }, +- { "Speaker Output", NULL, "TOCLK" }, +- { "Speaker Output", NULL, "TEMP_SPK" }, ++ { "SPKOUTL Output", NULL, "Speaker PGA" }, ++ { "SPKOUTL Output", NULL, "SYSCLK" }, ++ { "SPKOUTL Output", NULL, "TOCLK" }, ++ { "SPKOUTL Output", NULL, "TEMP_SPK" }, ++ ++ { "SPKOUTR Output", NULL, "Speaker PGA" }, ++ { "SPKOUTR Output", NULL, "SYSCLK" }, ++ { "SPKOUTR Output", NULL, "TOCLK" }, ++ { "SPKOUTR Output", NULL, "TEMP_SPK" }, + +- { "SPKOUT", NULL, "Speaker Output" }, ++ { "SPKOUT", NULL, "SPKOUTL Output" }, ++ { "SPKOUT", NULL, "SPKOUTR Output" }, + }; + + static const struct snd_soc_dapm_route wm8962_spk_stereo_intercon[] = { +-- +2.43.0 + diff --git a/queue-6.1/asoc-wm8962-enable-oscillator-if-selecting-wm8962_fl.patch b/queue-6.1/asoc-wm8962-enable-oscillator-if-selecting-wm8962_fl.patch new file mode 100644 index 00000000000..89164de1c7f --- /dev/null +++ b/queue-6.1/asoc-wm8962-enable-oscillator-if-selecting-wm8962_fl.patch @@ -0,0 +1,37 @@ +From 5d54d0242b12283854c0a45801e11b702e3d93b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 16:14:35 +0000 +Subject: ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC + +From: Stuart Henderson + +[ Upstream commit 03c7874106ca5032a312626b927b1c35f07b1f35 ] + +Signed-off-by: Stuart Henderson +Link: https://msgid.link/r/20240306161439.1385643-1-stuarth@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index b901e4c65e8a5..35d8cd4fc71a7 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -2914,8 +2914,12 @@ static int wm8962_set_fll(struct snd_soc_component *component, int fll_id, int s + switch (fll_id) { + case WM8962_FLL_MCLK: + case WM8962_FLL_BCLK: ++ fll1 |= (fll_id - 1) << WM8962_FLL_REFCLK_SRC_SHIFT; ++ break; + case WM8962_FLL_OSC: + fll1 |= (fll_id - 1) << WM8962_FLL_REFCLK_SRC_SHIFT; ++ snd_soc_component_update_bits(component, WM8962_PLL2, ++ WM8962_OSC_ENA, WM8962_OSC_ENA); + break; + case WM8962_FLL_INT: + snd_soc_component_update_bits(component, WM8962_FLL_CONTROL_1, +-- +2.43.0 + diff --git a/queue-6.1/asoc-wm8962-fix-up-incorrect-error-message-in-wm8962.patch b/queue-6.1/asoc-wm8962-fix-up-incorrect-error-message-in-wm8962.patch new file mode 100644 index 00000000000..e1651b002de --- /dev/null +++ b/queue-6.1/asoc-wm8962-fix-up-incorrect-error-message-in-wm8962.patch @@ -0,0 +1,36 @@ +From ca69d95e6225d465f57765e09c849fb89698dbff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 16:14:39 +0000 +Subject: ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll + +From: Stuart Henderson + +[ Upstream commit 96e202f8c52ac49452f83317cf3b34cd1ad81e18 ] + +Use source instead of ret, which seems to be unrelated and will always +be zero. + +Signed-off-by: Stuart Henderson +Link: https://msgid.link/r/20240306161439.1385643-5-stuarth@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index 806b69c9b2e36..d215e58c4a7b3 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -2933,7 +2933,7 @@ static int wm8962_set_fll(struct snd_soc_component *component, int fll_id, int s + WM8962_FLL_FRC_NCO, WM8962_FLL_FRC_NCO); + break; + default: +- dev_err(component->dev, "Unknown FLL source %d\n", ret); ++ dev_err(component->dev, "Unknown FLL source %d\n", source); + return -EINVAL; + } + +-- +2.43.0 + diff --git a/queue-6.1/block-sed-opal-handle-empty-atoms-when-parsing-respo.patch b/queue-6.1/block-sed-opal-handle-empty-atoms-when-parsing-respo.patch new file mode 100644 index 00000000000..f99805c747b --- /dev/null +++ b/queue-6.1/block-sed-opal-handle-empty-atoms-when-parsing-respo.patch @@ -0,0 +1,65 @@ +From cc3951d8b07cc3f7804c4b33f44a20462fdfec37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 15:04:17 -0600 +Subject: block: sed-opal: handle empty atoms when parsing response + +From: Greg Joyce + +[ Upstream commit 5429c8de56f6b2bd8f537df3a1e04e67b9c04282 ] + +The SED Opal response parsing function response_parse() does not +handle the case of an empty atom in the response. This causes +the entry count to be too high and the response fails to be +parsed. Recognizing, but ignoring, empty atoms allows response +handling to succeed. + +Signed-off-by: Greg Joyce +Link: https://lore.kernel.org/r/20240216210417.3526064-2-gjoyce@linux.ibm.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/opal_proto.h | 1 + + block/sed-opal.c | 6 +++++- + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/block/opal_proto.h b/block/opal_proto.h +index 7152aa1f1a49e..7f306b08a0fe7 100644 +--- a/block/opal_proto.h ++++ b/block/opal_proto.h +@@ -71,6 +71,7 @@ enum opal_response_token { + #define SHORT_ATOM_BYTE 0xBF + #define MEDIUM_ATOM_BYTE 0xDF + #define LONG_ATOM_BYTE 0xE3 ++#define EMPTY_ATOM_BYTE 0xFF + + #define OPAL_INVAL_PARAM 12 + #define OPAL_MANUFACTURED_INACTIVE 0x08 +diff --git a/block/sed-opal.c b/block/sed-opal.c +index 9bdb833e5817d..25e4ce452c1d3 100644 +--- a/block/sed-opal.c ++++ b/block/sed-opal.c +@@ -935,16 +935,20 @@ static int response_parse(const u8 *buf, size_t length, + token_length = response_parse_medium(iter, pos); + else if (pos[0] <= LONG_ATOM_BYTE) /* long atom */ + token_length = response_parse_long(iter, pos); ++ else if (pos[0] == EMPTY_ATOM_BYTE) /* empty atom */ ++ token_length = 1; + else /* TOKEN */ + token_length = response_parse_token(iter, pos); + + if (token_length < 0) + return token_length; + ++ if (pos[0] != EMPTY_ATOM_BYTE) ++ num_entries++; ++ + pos += token_length; + total -= token_length; + iter++; +- num_entries++; + } + + resp->num = num_entries; +-- +2.43.0 + diff --git a/queue-6.1/bluetooth-mgmt-fix-limited-discoverable-off-timeout.patch b/queue-6.1/bluetooth-mgmt-fix-limited-discoverable-off-timeout.patch new file mode 100644 index 00000000000..d9a23f867ac --- /dev/null +++ b/queue-6.1/bluetooth-mgmt-fix-limited-discoverable-off-timeout.patch @@ -0,0 +1,51 @@ +From 5c8a15f419d976b807e9d458b76984d172a087ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 17:59:55 +0100 +Subject: Bluetooth: mgmt: Fix limited discoverable off timeout +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Frédéric Danis + +[ Upstream commit 0bd1fb586235224048c726922db048d1bce6354a ] + +LIMITED_DISCOVERABLE flag is not reset from Class of Device and +advertisement on limited discoverable timeout. This prevents to pass PTS +test GAP/DISC/LIMM/BV-02-C + +Calling set_discoverable_sync as when the limited discovery is set +correctly update the Class of Device and advertisement. + +Signed-off-by: Frédéric Danis +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 6d631a2e60166..ab63f807e3c80 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -1039,6 +1039,8 @@ static void rpa_expired(struct work_struct *work) + hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL); + } + ++static int set_discoverable_sync(struct hci_dev *hdev, void *data); ++ + static void discov_off(struct work_struct *work) + { + struct hci_dev *hdev = container_of(work, struct hci_dev, +@@ -1057,7 +1059,7 @@ static void discov_off(struct work_struct *work) + hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); + hdev->discov_timeout = 0; + +- hci_update_discoverable(hdev); ++ hci_cmd_sync_queue(hdev, set_discoverable_sync, NULL, NULL); + + mgmt_new_settings(hdev); + +-- +2.43.0 + diff --git a/queue-6.1/bluetooth-rfcomm-fix-null-ptr-deref-in-rfcomm_check_.patch b/queue-6.1/bluetooth-rfcomm-fix-null-ptr-deref-in-rfcomm_check_.patch new file mode 100644 index 00000000000..9b4d0078909 --- /dev/null +++ b/queue-6.1/bluetooth-rfcomm-fix-null-ptr-deref-in-rfcomm_check_.patch @@ -0,0 +1,58 @@ +From cad83ccb364dd85b05b170ca2b9214d628aa0ad2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 17:10:43 +0800 +Subject: Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security + +From: Yuxuan Hu <20373622@buaa.edu.cn> + +[ Upstream commit 2535b848fa0f42ddff3e5255cf5e742c9b77bb26 ] + +During our fuzz testing of the connection and disconnection process at the +RFCOMM layer, we discovered this bug. By comparing the packets from a +normal connection and disconnection process with the testcase that +triggered a KASAN report. We analyzed the cause of this bug as follows: + +1. In the packets captured during a normal connection, the host sends a +`Read Encryption Key Size` type of `HCI_CMD` packet +(Command Opcode: 0x1408) to the controller to inquire the length of +encryption key.After receiving this packet, the controller immediately +replies with a Command Completepacket (Event Code: 0x0e) to return the +Encryption Key Size. + +2. In our fuzz test case, the timing of the controller's response to this +packet was delayed to an unexpected point: after the RFCOMM and L2CAP +layers had disconnected but before the HCI layer had disconnected. + +3. After receiving the Encryption Key Size Response at the time described +in point 2, the host still called the rfcomm_check_security function. +However, by this time `struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;` +had already been released, and when the function executed +`return hci_conn_security(conn->hcon, d->sec_level, auth_type, d->out);`, +specifically when accessing `conn->hcon`, a null-ptr-deref error occurred. + +To fix this bug, check if `sk->sk_state` is BT_CLOSED before calling +rfcomm_recv_frame in rfcomm_process_rx. + +Signed-off-by: Yuxuan Hu <20373622@buaa.edu.cn> +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/rfcomm/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c +index 8d6fce9005bdd..4f54c7df3a94f 100644 +--- a/net/bluetooth/rfcomm/core.c ++++ b/net/bluetooth/rfcomm/core.c +@@ -1937,7 +1937,7 @@ static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s) + /* Get data directly from socket receive queue without copying it. */ + while ((skb = skb_dequeue(&sk->sk_receive_queue))) { + skb_orphan(skb); +- if (!skb_linearize(skb)) { ++ if (!skb_linearize(skb) && sk->sk_state != BT_CLOSED) { + s = rfcomm_recv_frame(s, skb); + if (!s) + break; +-- +2.43.0 + diff --git a/queue-6.1/btrfs-fix-data-race-at-btrfs_use_block_rsv-when-acce.patch b/queue-6.1/btrfs-fix-data-race-at-btrfs_use_block_rsv-when-acce.patch new file mode 100644 index 00000000000..ecc0e074a02 --- /dev/null +++ b/queue-6.1/btrfs-fix-data-race-at-btrfs_use_block_rsv-when-acce.patch @@ -0,0 +1,104 @@ +From 91ab2a0aa6c75c52784e1d58aa3a712fa5bc48df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 20:10:07 +0000 +Subject: btrfs: fix data race at btrfs_use_block_rsv() when accessing block + reserve + +From: Filipe Manana + +[ Upstream commit c7bb26b847e5b97814f522686068c5628e2b3646 ] + +At btrfs_use_block_rsv() we read the size of a block reserve without +locking its spinlock, which makes KCSAN complain because the size of a +block reserve is always updated while holding its spinlock. The report +from KCSAN is the following: + + [653.313148] BUG: KCSAN: data-race in btrfs_update_delayed_refs_rsv [btrfs] / btrfs_use_block_rsv [btrfs] + + [653.314755] read to 0x000000017f5871b8 of 8 bytes by task 7519 on cpu 0: + [653.314779] btrfs_use_block_rsv+0xe4/0x2f8 [btrfs] + [653.315606] btrfs_alloc_tree_block+0xdc/0x998 [btrfs] + [653.316421] btrfs_force_cow_block+0x220/0xe38 [btrfs] + [653.317242] btrfs_cow_block+0x1ac/0x568 [btrfs] + [653.318060] btrfs_search_slot+0xda2/0x19b8 [btrfs] + [653.318879] btrfs_del_csums+0x1dc/0x798 [btrfs] + [653.319702] __btrfs_free_extent.isra.0+0xc24/0x2028 [btrfs] + [653.320538] __btrfs_run_delayed_refs+0xd3c/0x2390 [btrfs] + [653.321340] btrfs_run_delayed_refs+0xae/0x290 [btrfs] + [653.322140] flush_space+0x5e4/0x718 [btrfs] + [653.322958] btrfs_preempt_reclaim_metadata_space+0x102/0x2f8 [btrfs] + [653.323781] process_one_work+0x3b6/0x838 + [653.323800] worker_thread+0x75e/0xb10 + [653.323817] kthread+0x21a/0x230 + [653.323836] __ret_from_fork+0x6c/0xb8 + [653.323855] ret_from_fork+0xa/0x30 + + [653.323887] write to 0x000000017f5871b8 of 8 bytes by task 576 on cpu 3: + [653.323906] btrfs_update_delayed_refs_rsv+0x1a4/0x250 [btrfs] + [653.324699] btrfs_add_delayed_data_ref+0x468/0x6d8 [btrfs] + [653.325494] btrfs_free_extent+0x76/0x120 [btrfs] + [653.326280] __btrfs_mod_ref+0x6a8/0x6b8 [btrfs] + [653.327064] btrfs_dec_ref+0x50/0x70 [btrfs] + [653.327849] walk_up_proc+0x236/0xa50 [btrfs] + [653.328633] walk_up_tree+0x21c/0x448 [btrfs] + [653.329418] btrfs_drop_snapshot+0x802/0x1328 [btrfs] + [653.330205] btrfs_clean_one_deleted_snapshot+0x184/0x238 [btrfs] + [653.330995] cleaner_kthread+0x2b0/0x2f0 [btrfs] + [653.331781] kthread+0x21a/0x230 + [653.331800] __ret_from_fork+0x6c/0xb8 + [653.331818] ret_from_fork+0xa/0x30 + +So add a helper to get the size of a block reserve while holding the lock. +Reading the field while holding the lock instead of using the data_race() +annotation is used in order to prevent load tearing. + +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/block-rsv.c | 2 +- + fs/btrfs/block-rsv.h | 16 ++++++++++++++++ + 2 files changed, 17 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/block-rsv.c b/fs/btrfs/block-rsv.c +index 507b44d18572d..4cbf386166209 100644 +--- a/fs/btrfs/block-rsv.c ++++ b/fs/btrfs/block-rsv.c +@@ -512,7 +512,7 @@ struct btrfs_block_rsv *btrfs_use_block_rsv(struct btrfs_trans_handle *trans, + + block_rsv = get_block_rsv(trans, root); + +- if (unlikely(block_rsv->size == 0)) ++ if (unlikely(btrfs_block_rsv_size(block_rsv) == 0)) + goto try_reserve; + again: + ret = btrfs_block_rsv_use_bytes(block_rsv, blocksize); +diff --git a/fs/btrfs/block-rsv.h b/fs/btrfs/block-rsv.h +index cda79d3e0c263..df87c4949d065 100644 +--- a/fs/btrfs/block-rsv.h ++++ b/fs/btrfs/block-rsv.h +@@ -117,4 +117,20 @@ static inline u64 btrfs_block_rsv_reserved(struct btrfs_block_rsv *rsv) + return ret; + } + ++/* ++ * Get the size of a block reserve in a context where getting a stale value is ++ * acceptable, instead of accessing it directly and trigger data race warning ++ * from KCSAN. ++ */ ++static inline u64 btrfs_block_rsv_size(struct btrfs_block_rsv *rsv) ++{ ++ u64 ret; ++ ++ spin_lock(&rsv->lock); ++ ret = rsv->size; ++ spin_unlock(&rsv->lock); ++ ++ return ret; ++} ++ + #endif /* BTRFS_BLOCK_RSV_H */ +-- +2.43.0 + diff --git a/queue-6.1/btrfs-fix-data-races-when-accessing-the-reserved-amo.patch b/queue-6.1/btrfs-fix-data-races-when-accessing-the-reserved-amo.patch new file mode 100644 index 00000000000..d220faac52d --- /dev/null +++ b/queue-6.1/btrfs-fix-data-races-when-accessing-the-reserved-amo.patch @@ -0,0 +1,164 @@ +From 883fc21c8d62c4048ca6ec3e08321cb3260018dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 19:41:23 +0000 +Subject: btrfs: fix data races when accessing the reserved amount of block + reserves + +From: Filipe Manana + +[ Upstream commit e06cc89475eddc1f3a7a4d471524256152c68166 ] + +At space_info.c we have several places where we access the ->reserved +field of a block reserve without taking the block reserve's spinlock +first, which makes KCSAN warn about a data race since that field is +always updated while holding the spinlock. + +The reports from KCSAN are like the following: + + [117.193526] BUG: KCSAN: data-race in btrfs_block_rsv_release [btrfs] / need_preemptive_reclaim [btrfs] + + [117.195148] read to 0x000000017f587190 of 8 bytes by task 6303 on cpu 3: + [117.195172] need_preemptive_reclaim+0x222/0x2f0 [btrfs] + [117.195992] __reserve_bytes+0xbb0/0xdc8 [btrfs] + [117.196807] btrfs_reserve_metadata_bytes+0x4c/0x120 [btrfs] + [117.197620] btrfs_block_rsv_add+0x78/0xa8 [btrfs] + [117.198434] btrfs_delayed_update_inode+0x154/0x368 [btrfs] + [117.199300] btrfs_update_inode+0x108/0x1c8 [btrfs] + [117.200122] btrfs_dirty_inode+0xb4/0x140 [btrfs] + [117.200937] btrfs_update_time+0x8c/0xb0 [btrfs] + [117.201754] touch_atime+0x16c/0x1e0 + [117.201789] filemap_read+0x674/0x728 + [117.201823] btrfs_file_read_iter+0xf8/0x410 [btrfs] + [117.202653] vfs_read+0x2b6/0x498 + [117.203454] ksys_read+0xa2/0x150 + [117.203473] __s390x_sys_read+0x68/0x88 + [117.203495] do_syscall+0x1c6/0x210 + [117.203517] __do_syscall+0xc8/0xf0 + [117.203539] system_call+0x70/0x98 + + [117.203579] write to 0x000000017f587190 of 8 bytes by task 11 on cpu 0: + [117.203604] btrfs_block_rsv_release+0x2e8/0x578 [btrfs] + [117.204432] btrfs_delayed_inode_release_metadata+0x7c/0x1d0 [btrfs] + [117.205259] __btrfs_update_delayed_inode+0x37c/0x5e0 [btrfs] + [117.206093] btrfs_async_run_delayed_root+0x356/0x498 [btrfs] + [117.206917] btrfs_work_helper+0x160/0x7a0 [btrfs] + [117.207738] process_one_work+0x3b6/0x838 + [117.207768] worker_thread+0x75e/0xb10 + [117.207797] kthread+0x21a/0x230 + [117.207830] __ret_from_fork+0x6c/0xb8 + [117.207861] ret_from_fork+0xa/0x30 + +So add a helper to get the reserved amount of a block reserve while +holding the lock. The value may be not be up to date anymore when used by +need_preemptive_reclaim() and btrfs_preempt_reclaim_metadata_space(), but +that's ok since the worst it can do is cause more reclaim work do be done +sooner rather than later. Reading the field while holding the lock instead +of using the data_race() annotation is used in order to prevent load +tearing. + +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/block-rsv.h | 16 ++++++++++++++++ + fs/btrfs/space-info.c | 26 +++++++++++++------------- + 2 files changed, 29 insertions(+), 13 deletions(-) + +diff --git a/fs/btrfs/block-rsv.h b/fs/btrfs/block-rsv.h +index 578c3497a455c..cda79d3e0c263 100644 +--- a/fs/btrfs/block-rsv.h ++++ b/fs/btrfs/block-rsv.h +@@ -101,4 +101,20 @@ static inline bool btrfs_block_rsv_full(const struct btrfs_block_rsv *rsv) + return data_race(rsv->full); + } + ++/* ++ * Get the reserved mount of a block reserve in a context where getting a stale ++ * value is acceptable, instead of accessing it directly and trigger data race ++ * warning from KCSAN. ++ */ ++static inline u64 btrfs_block_rsv_reserved(struct btrfs_block_rsv *rsv) ++{ ++ u64 ret; ++ ++ spin_lock(&rsv->lock); ++ ret = rsv->reserved; ++ spin_unlock(&rsv->lock); ++ ++ return ret; ++} ++ + #endif /* BTRFS_BLOCK_RSV_H */ +diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c +index 2635fb4bffa06..8b75f436a9a3c 100644 +--- a/fs/btrfs/space-info.c ++++ b/fs/btrfs/space-info.c +@@ -847,7 +847,7 @@ btrfs_calc_reclaim_metadata_size(struct btrfs_fs_info *fs_info, + static bool need_preemptive_reclaim(struct btrfs_fs_info *fs_info, + struct btrfs_space_info *space_info) + { +- u64 global_rsv_size = fs_info->global_block_rsv.reserved; ++ const u64 global_rsv_size = btrfs_block_rsv_reserved(&fs_info->global_block_rsv); + u64 ordered, delalloc; + u64 total = writable_total_bytes(fs_info, space_info); + u64 thresh; +@@ -948,8 +948,8 @@ static bool need_preemptive_reclaim(struct btrfs_fs_info *fs_info, + ordered = percpu_counter_read_positive(&fs_info->ordered_bytes) >> 1; + delalloc = percpu_counter_read_positive(&fs_info->delalloc_bytes); + if (ordered >= delalloc) +- used += fs_info->delayed_refs_rsv.reserved + +- fs_info->delayed_block_rsv.reserved; ++ used += btrfs_block_rsv_reserved(&fs_info->delayed_refs_rsv) + ++ btrfs_block_rsv_reserved(&fs_info->delayed_block_rsv); + else + used += space_info->bytes_may_use - global_rsv_size; + +@@ -1164,7 +1164,7 @@ static void btrfs_preempt_reclaim_metadata_space(struct work_struct *work) + enum btrfs_flush_state flush; + u64 delalloc_size = 0; + u64 to_reclaim, block_rsv_size; +- u64 global_rsv_size = global_rsv->reserved; ++ const u64 global_rsv_size = btrfs_block_rsv_reserved(global_rsv); + + loops++; + +@@ -1176,9 +1176,9 @@ static void btrfs_preempt_reclaim_metadata_space(struct work_struct *work) + * assume it's tied up in delalloc reservations. + */ + block_rsv_size = global_rsv_size + +- delayed_block_rsv->reserved + +- delayed_refs_rsv->reserved + +- trans_rsv->reserved; ++ btrfs_block_rsv_reserved(delayed_block_rsv) + ++ btrfs_block_rsv_reserved(delayed_refs_rsv) + ++ btrfs_block_rsv_reserved(trans_rsv); + if (block_rsv_size < space_info->bytes_may_use) + delalloc_size = space_info->bytes_may_use - block_rsv_size; + +@@ -1198,16 +1198,16 @@ static void btrfs_preempt_reclaim_metadata_space(struct work_struct *work) + to_reclaim = delalloc_size; + flush = FLUSH_DELALLOC; + } else if (space_info->bytes_pinned > +- (delayed_block_rsv->reserved + +- delayed_refs_rsv->reserved)) { ++ (btrfs_block_rsv_reserved(delayed_block_rsv) + ++ btrfs_block_rsv_reserved(delayed_refs_rsv))) { + to_reclaim = space_info->bytes_pinned; + flush = COMMIT_TRANS; +- } else if (delayed_block_rsv->reserved > +- delayed_refs_rsv->reserved) { +- to_reclaim = delayed_block_rsv->reserved; ++ } else if (btrfs_block_rsv_reserved(delayed_block_rsv) > ++ btrfs_block_rsv_reserved(delayed_refs_rsv)) { ++ to_reclaim = btrfs_block_rsv_reserved(delayed_block_rsv); + flush = FLUSH_DELAYED_ITEMS_NR; + } else { +- to_reclaim = delayed_refs_rsv->reserved; ++ to_reclaim = btrfs_block_rsv_reserved(delayed_refs_rsv); + flush = FLUSH_DELAYED_REFS_NR; + } + +-- +2.43.0 + diff --git a/queue-6.1/dm-verity-dm-crypt-align-struct-bvec_iter-correctly.patch b/queue-6.1/dm-verity-dm-crypt-align-struct-bvec_iter-correctly.patch new file mode 100644 index 00000000000..e3cc3680b89 --- /dev/null +++ b/queue-6.1/dm-verity-dm-crypt-align-struct-bvec_iter-correctly.patch @@ -0,0 +1,71 @@ +From 320d818da76028188f19af4d0232c4bc2f4785f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Feb 2024 19:11:51 +0100 +Subject: dm-verity, dm-crypt: align "struct bvec_iter" correctly + +From: Mikulas Patocka + +[ Upstream commit 787f1b2800464aa277236a66eb3c279535edd460 ] + +"struct bvec_iter" is defined with the __packed attribute, so it is +aligned on a single byte. On X86 (and on other architectures that support +unaligned addresses in hardware), "struct bvec_iter" is accessed using the +8-byte and 4-byte memory instructions, however these instructions are less +efficient if they operate on unaligned addresses. + +(on RISC machines that don't have unaligned access in hardware, GCC +generates byte-by-byte accesses that are very inefficient - see [1]) + +This commit reorders the entries in "struct dm_verity_io" and "struct +convert_context", so that "struct bvec_iter" is aligned on 8 bytes. + +[1] https://lore.kernel.org/all/ZcLuWUNRZadJr0tQ@fedora/T/ + +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-crypt.c | 4 ++-- + drivers/md/dm-verity.h | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 3e215aa85b99a..e8c534b5870ac 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -52,11 +52,11 @@ + struct convert_context { + struct completion restart; + struct bio *bio_in; +- struct bio *bio_out; + struct bvec_iter iter_in; ++ struct bio *bio_out; + struct bvec_iter iter_out; +- u64 cc_sector; + atomic_t cc_pending; ++ u64 cc_sector; + union { + struct skcipher_request *req; + struct aead_request *req_aead; +diff --git a/drivers/md/dm-verity.h b/drivers/md/dm-verity.h +index 4620a98c99561..db93a91169d5e 100644 +--- a/drivers/md/dm-verity.h ++++ b/drivers/md/dm-verity.h +@@ -80,12 +80,12 @@ struct dm_verity_io { + /* original value of bio->bi_end_io */ + bio_end_io_t *orig_bi_end_io; + ++ struct bvec_iter iter; ++ + sector_t block; + unsigned int n_blocks; + bool in_tasklet; + +- struct bvec_iter iter; +- + struct work_struct work; + + char *recheck_buffer; +-- +2.43.0 + diff --git a/queue-6.1/drm-amdgpu-enable-gpu-reset-for-s3-abort-cases-on-ra.patch b/queue-6.1/drm-amdgpu-enable-gpu-reset-for-s3-abort-cases-on-ra.patch new file mode 100644 index 00000000000..ac769860797 --- /dev/null +++ b/queue-6.1/drm-amdgpu-enable-gpu-reset-for-s3-abort-cases-on-ra.patch @@ -0,0 +1,90 @@ +From 04f5bffe61ef4eaed78063f8b4eb29a2581f9bbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 20:56:59 +0800 +Subject: drm/amdgpu: Enable gpu reset for S3 abort cases on Raven series + +From: Prike Liang + +[ Upstream commit c671ec01311b4744b377f98b0b4c6d033fe569b3 ] + +Currently, GPU resets can now be performed successfully on the Raven +series. While GPU reset is required for the S3 suspend abort case. +So now can enable gpu reset for S3 abort cases on the Raven series. + +Signed-off-by: Prike Liang +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/soc15.c | 45 +++++++++++++++++------------- + 1 file changed, 25 insertions(+), 20 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c +index 489c89465c78b..c373a2a3248eb 100644 +--- a/drivers/gpu/drm/amd/amdgpu/soc15.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c +@@ -584,11 +584,34 @@ soc15_asic_reset_method(struct amdgpu_device *adev) + return AMD_RESET_METHOD_MODE1; + } + ++static bool soc15_need_reset_on_resume(struct amdgpu_device *adev) ++{ ++ u32 sol_reg; ++ ++ sol_reg = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_81); ++ ++ /* Will reset for the following suspend abort cases. ++ * 1) Only reset limit on APU side, dGPU hasn't checked yet. ++ * 2) S3 suspend abort and TOS already launched. ++ */ ++ if (adev->flags & AMD_IS_APU && adev->in_s3 && ++ !adev->suspend_complete && ++ sol_reg) ++ return true; ++ ++ return false; ++} ++ + static int soc15_asic_reset(struct amdgpu_device *adev) + { + /* original raven doesn't have full asic reset */ +- if ((adev->apu_flags & AMD_APU_IS_RAVEN) || +- (adev->apu_flags & AMD_APU_IS_RAVEN2)) ++ /* On the latest Raven, the GPU reset can be performed ++ * successfully. So now, temporarily enable it for the ++ * S3 suspend abort case. ++ */ ++ if (((adev->apu_flags & AMD_APU_IS_RAVEN) || ++ (adev->apu_flags & AMD_APU_IS_RAVEN2)) && ++ !soc15_need_reset_on_resume(adev)) + return 0; + + switch (soc15_asic_reset_method(adev)) { +@@ -1285,24 +1308,6 @@ static int soc15_common_suspend(void *handle) + return soc15_common_hw_fini(adev); + } + +-static bool soc15_need_reset_on_resume(struct amdgpu_device *adev) +-{ +- u32 sol_reg; +- +- sol_reg = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_81); +- +- /* Will reset for the following suspend abort cases. +- * 1) Only reset limit on APU side, dGPU hasn't checked yet. +- * 2) S3 suspend abort and TOS already launched. +- */ +- if (adev->flags & AMD_IS_APU && adev->in_s3 && +- !adev->suspend_complete && +- sol_reg) +- return true; +- +- return false; +-} +- + static int soc15_common_resume(void *handle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)handle; +-- +2.43.0 + diff --git a/queue-6.1/firewire-core-use-long-bus-reset-on-gap-count-error.patch b/queue-6.1/firewire-core-use-long-bus-reset-on-gap-count-error.patch new file mode 100644 index 00000000000..b48cb85bd12 --- /dev/null +++ b/queue-6.1/firewire-core-use-long-bus-reset-on-gap-count-error.patch @@ -0,0 +1,65 @@ +From a8f9f84894f9fe9408a17d49e29be600ca10e369 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 22:17:37 +0900 +Subject: firewire: core: use long bus reset on gap count error + +From: Takashi Sakamoto + +[ Upstream commit d0b06dc48fb15902d7da09c5c0861e7f042a9381 ] + +When resetting the bus after a gap count error, use a long rather than +short bus reset. + +IEEE 1394-1995 uses only long bus resets. IEEE 1394a adds the option of +short bus resets. When video or audio transmission is in progress and a +device is hot-plugged elsewhere on the bus, the resulting bus reset can +cause video frame drops or audio dropouts. Short bus resets reduce or +eliminate this problem. Accordingly, short bus resets are almost always +preferred. + +However, on a mixed 1394/1394a bus, a short bus reset can trigger an +immediate additional bus reset. This double bus reset can be interpreted +differently by different nodes on the bus, resulting in an inconsistent gap +count after the bus reset. An inconsistent gap count will cause another bus +reset, leading to a neverending bus reset loop. This only happens for some +bus topologies, not for all mixed 1394/1394a buses. + +By instead sending a long bus reset after a gap count inconsistency, we +avoid the doubled bus reset, restoring the bus to normal operation. + +Signed-off-by: Adam Goldman +Link: https://sourceforge.net/p/linux1394/mailman/message/58741624/ +Signed-off-by: Takashi Sakamoto +Signed-off-by: Sasha Levin +--- + drivers/firewire/core-card.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c +index 8aaa7fcb2630d..401a77e3b5fa8 100644 +--- a/drivers/firewire/core-card.c ++++ b/drivers/firewire/core-card.c +@@ -500,7 +500,19 @@ static void bm_work(struct work_struct *work) + fw_notice(card, "phy config: new root=%x, gap_count=%d\n", + new_root_id, gap_count); + fw_send_phy_config(card, new_root_id, generation, gap_count); +- reset_bus(card, true); ++ /* ++ * Where possible, use a short bus reset to minimize ++ * disruption to isochronous transfers. But in the event ++ * of a gap count inconsistency, use a long bus reset. ++ * ++ * As noted in 1394a 8.4.6.2, nodes on a mixed 1394/1394a bus ++ * may set different gap counts after a bus reset. On a mixed ++ * 1394/1394a bus, a short bus reset can get doubled. Some ++ * nodes may treat the double reset as one bus reset and others ++ * may treat it as two, causing a gap count inconsistency ++ * again. Using a long bus reset prevents this. ++ */ ++ reset_bus(card, card->gap_count != 0); + /* Will allocate broadcast channel after the reset. */ + goto out; + } +-- +2.43.0 + diff --git a/queue-6.1/gen_compile_commands-fix-invalid-escape-sequence-war.patch b/queue-6.1/gen_compile_commands-fix-invalid-escape-sequence-war.patch new file mode 100644 index 00000000000..ad020c57919 --- /dev/null +++ b/queue-6.1/gen_compile_commands-fix-invalid-escape-sequence-war.patch @@ -0,0 +1,36 @@ +From 2da0937423e8a0f6a4a5e6ad257904e2fdb51b64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 19:23:05 -0600 +Subject: gen_compile_commands: fix invalid escape sequence warning + +From: Andrew Ballance + +[ Upstream commit dae4a0171e25884787da32823b3081b4c2acebb2 ] + +With python 3.12, '\#' results in this warning + SyntaxWarning: invalid escape sequence '\#' + +Signed-off-by: Andrew Ballance +Reviewed-by: Justin Stitt +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/clang-tools/gen_compile_commands.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/clang-tools/gen_compile_commands.py b/scripts/clang-tools/gen_compile_commands.py +index d800b2c0af977..4f414ab706bd8 100755 +--- a/scripts/clang-tools/gen_compile_commands.py ++++ b/scripts/clang-tools/gen_compile_commands.py +@@ -170,7 +170,7 @@ def process_line(root_directory, command_prefix, file_path): + # escape the pound sign '#', either as '\#' or '$(pound)' (depending on the + # kernel version). The compile_commands.json file is not interepreted + # by Make, so this code replaces the escaped version with '#'. +- prefix = command_prefix.replace('\#', '#').replace('$(pound)', '#') ++ prefix = command_prefix.replace(r'\#', '#').replace('$(pound)', '#') + + # Use os.path.abspath() to normalize the path resolving '.' and '..' . + abs_path = os.path.abspath(os.path.join(root_directory, file_path)) +-- +2.43.0 + diff --git a/queue-6.1/hid-multitouch-add-required-quirk-for-synaptics-0xcd.patch b/queue-6.1/hid-multitouch-add-required-quirk-for-synaptics-0xcd.patch new file mode 100644 index 00000000000..8931ba0f627 --- /dev/null +++ b/queue-6.1/hid-multitouch-add-required-quirk-for-synaptics-0xcd.patch @@ -0,0 +1,40 @@ +From 9579a131199c2f8207038dde72e0e949c99173d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Feb 2024 19:04:29 +0000 +Subject: HID: multitouch: Add required quirk for Synaptics 0xcddc device + +From: Manuel Fombuena + +[ Upstream commit 1741a8269e1c51fa08d4bfdf34667387a6eb10ec ] + +Add support for the pointing stick (Accupoint) and 2 mouse buttons. + +Present on some Toshiba/dynabook Portege X30 and X40 laptops. + +It should close https://bugzilla.kernel.org/show_bug.cgi?id=205817 + +Signed-off-by: Manuel Fombuena +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-multitouch.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 5ec1f174127a3..3816fd06bc953 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -2153,6 +2153,10 @@ static const struct hid_device_id mt_devices[] = { + HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, + USB_VENDOR_ID_SYNAPTICS, 0xcd7e) }, + ++ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT, ++ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, ++ USB_VENDOR_ID_SYNAPTICS, 0xcddc) }, ++ + { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT, + HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, + USB_VENDOR_ID_SYNAPTICS, 0xce08) }, +-- +2.43.0 + diff --git a/queue-6.1/input-gpio_keys_polled-suppress-deferred-probe-error.patch b/queue-6.1/input-gpio_keys_polled-suppress-deferred-probe-error.patch new file mode 100644 index 00000000000..56210a690c3 --- /dev/null +++ b/queue-6.1/input-gpio_keys_polled-suppress-deferred-probe-error.patch @@ -0,0 +1,55 @@ +From a0e78e2946903cb8b305af3165b5d1ba53a0bdb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 11:10:42 +0100 +Subject: Input: gpio_keys_polled - suppress deferred probe error for gpio +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 963465a33141d0d52338e77f80fe543d2c9dc053 ] + +On a PC Engines APU our admins are faced with: + + $ dmesg | grep -c "gpio-keys-polled gpio-keys-polled: unable to claim gpio 0, err=-517" + 261 + +Such a message always appears when e.g. a new USB device is plugged in. + +Suppress this message which considerably clutters the kernel log for +EPROBE_DEFER (i.e. -517). + +Signed-off-by: Uwe Kleine-König +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20240305101042.10953-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/gpio_keys_polled.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/input/keyboard/gpio_keys_polled.c b/drivers/input/keyboard/gpio_keys_polled.c +index c3937d2fc7446..a0f9978c68f55 100644 +--- a/drivers/input/keyboard/gpio_keys_polled.c ++++ b/drivers/input/keyboard/gpio_keys_polled.c +@@ -319,12 +319,10 @@ static int gpio_keys_polled_probe(struct platform_device *pdev) + + error = devm_gpio_request_one(dev, button->gpio, + flags, button->desc ? : DRV_NAME); +- if (error) { +- dev_err(dev, +- "unable to claim gpio %u, err=%d\n", +- button->gpio, error); +- return error; +- } ++ if (error) ++ return dev_err_probe(dev, error, ++ "unable to claim gpio %u\n", ++ button->gpio); + + bdata->gpiod = gpio_to_desc(button->gpio); + if (!bdata->gpiod) { +-- +2.43.0 + diff --git a/queue-6.1/media-rkisp1-fix-irq-handling-due-to-shared-interrup.patch b/queue-6.1/media-rkisp1-fix-irq-handling-due-to-shared-interrup.patch new file mode 100644 index 00000000000..37dec3b9f1e --- /dev/null +++ b/queue-6.1/media-rkisp1-fix-irq-handling-due-to-shared-interrup.patch @@ -0,0 +1,140 @@ +From 7a6b9150baf37b37b31f8d067307307e2b5dd947 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Dec 2023 08:54:01 +0100 +Subject: media: rkisp1: Fix IRQ handling due to shared interrupts + +From: Tomi Valkeinen + +[ Upstream commit ffb635bb398fc07cb38f8a7b4a82cbe5f412f08e ] + +The driver requests the interrupts as IRQF_SHARED, so the interrupt +handlers can be called at any time. If such a call happens while the ISP +is powered down, the SoC will hang as the driver tries to access the +ISP registers. + +This can be reproduced even without the platform sharing the IRQ line: +Enable CONFIG_DEBUG_SHIRQ and unload the driver, and the board will +hang. + +Fix this by adding a new field, 'irqs_enabled', which is used to bail +out from the interrupt handler when the ISP is not operational. + +Link: https://lore.kernel.org/r/20231218-rkisp-shirq-fix-v1-2-173007628248@ideasonboard.com + +Signed-off-by: Tomi Valkeinen +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../platform/rockchip/rkisp1/rkisp1-capture.c | 3 +++ + .../platform/rockchip/rkisp1/rkisp1-common.h | 2 ++ + .../platform/rockchip/rkisp1/rkisp1-csi.c | 3 +++ + .../platform/rockchip/rkisp1/rkisp1-dev.c | 22 +++++++++++++++++++ + .../platform/rockchip/rkisp1/rkisp1-isp.c | 3 +++ + 5 files changed, 33 insertions(+) + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c +index d4540684ea9af..0bcb9db5ad190 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c +@@ -701,6 +701,9 @@ irqreturn_t rkisp1_capture_isr(int irq, void *ctx) + unsigned int i; + u32 status; + ++ if (!rkisp1->irqs_enabled) ++ return IRQ_NONE; ++ + status = rkisp1_read(rkisp1, RKISP1_CIF_MI_MIS); + if (!status) + return IRQ_NONE; +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h +index f9ec1c6138947..5776292f914a4 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h +@@ -467,6 +467,7 @@ struct rkisp1_debug { + * @debug: debug params to be exposed on debugfs + * @info: version-specific ISP information + * @irqs: IRQ line numbers ++ * @irqs_enabled: the hardware is enabled and can cause interrupts + */ + struct rkisp1_device { + void __iomem *base_addr; +@@ -488,6 +489,7 @@ struct rkisp1_device { + struct rkisp1_debug debug; + const struct rkisp1_info *info; + int irqs[RKISP1_NUM_IRQS]; ++ bool irqs_enabled; + }; + + /* +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c +index e862f515cc6d3..95b6e41c48ec2 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c +@@ -211,6 +211,9 @@ irqreturn_t rkisp1_csi_isr(int irq, void *ctx) + struct rkisp1_device *rkisp1 = dev_get_drvdata(dev); + u32 val, status; + ++ if (!rkisp1->irqs_enabled) ++ return IRQ_NONE; ++ + status = rkisp1_read(rkisp1, RKISP1_CIF_MIPI_MIS); + if (!status) + return IRQ_NONE; +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c +index 41abb18b00acb..7a3b69ba51b97 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c +@@ -305,6 +305,24 @@ static int __maybe_unused rkisp1_runtime_suspend(struct device *dev) + { + struct rkisp1_device *rkisp1 = dev_get_drvdata(dev); + ++ rkisp1->irqs_enabled = false; ++ /* Make sure the IRQ handler will see the above */ ++ mb(); ++ ++ /* ++ * Wait until any running IRQ handler has returned. The IRQ handler ++ * may get called even after this (as it's a shared interrupt line) ++ * but the 'irqs_enabled' flag will make the handler return immediately. ++ */ ++ for (unsigned int il = 0; il < ARRAY_SIZE(rkisp1->irqs); ++il) { ++ if (rkisp1->irqs[il] == -1) ++ continue; ++ ++ /* Skip if the irq line is the same as previous */ ++ if (il == 0 || rkisp1->irqs[il - 1] != rkisp1->irqs[il]) ++ synchronize_irq(rkisp1->irqs[il]); ++ } ++ + clk_bulk_disable_unprepare(rkisp1->clk_size, rkisp1->clks); + return pinctrl_pm_select_sleep_state(dev); + } +@@ -321,6 +339,10 @@ static int __maybe_unused rkisp1_runtime_resume(struct device *dev) + if (ret) + return ret; + ++ rkisp1->irqs_enabled = true; ++ /* Make sure the IRQ handler will see the above */ ++ mb(); ++ + return 0; + } + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c +index 00dca284c1222..2af5c1a48070b 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c +@@ -1023,6 +1023,9 @@ irqreturn_t rkisp1_isp_isr(int irq, void *ctx) + struct rkisp1_device *rkisp1 = dev_get_drvdata(dev); + u32 status, isp_err; + ++ if (!rkisp1->irqs_enabled) ++ return IRQ_NONE; ++ + status = rkisp1_read(rkisp1, RKISP1_CIF_ISP_MIS); + if (!status) + return IRQ_NONE; +-- +2.43.0 + diff --git a/queue-6.1/mips-clear-cause.bd-in-instruction_pointer_set.patch b/queue-6.1/mips-clear-cause.bd-in-instruction_pointer_set.patch new file mode 100644 index 00000000000..82078c0f110 --- /dev/null +++ b/queue-6.1/mips-clear-cause.bd-in-instruction_pointer_set.patch @@ -0,0 +1,39 @@ +From 898b9432be5b6b86c647d7860d885d5037875da5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 12:30:27 +0000 +Subject: MIPS: Clear Cause.BD in instruction_pointer_set + +From: Jiaxun Yang + +[ Upstream commit 9d6e21ddf20293b3880ae55b9d14de91c5891c59 ] + +Clear Cause.BD after we use instruction_pointer_set to override +EPC. + +This can prevent exception_epc check against instruction code at +new return address. +It won't be considered as "in delay slot" after epc being overridden +anyway. + +Signed-off-by: Jiaxun Yang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/ptrace.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/mips/include/asm/ptrace.h b/arch/mips/include/asm/ptrace.h +index daf3cf244ea97..b3e4dd6be7e20 100644 +--- a/arch/mips/include/asm/ptrace.h ++++ b/arch/mips/include/asm/ptrace.h +@@ -60,6 +60,7 @@ static inline void instruction_pointer_set(struct pt_regs *regs, + unsigned long val) + { + regs->cp0_epc = val; ++ regs->cp0_cause &= ~CAUSEF_BD; + } + + /* Query offset/name of register from its name/offset */ +-- +2.43.0 + diff --git a/queue-6.1/net-iucv-fix-the-allocation-size-of-iucv_path_table-.patch b/queue-6.1/net-iucv-fix-the-allocation-size-of-iucv_path_table-.patch new file mode 100644 index 00000000000..b009c2b54ec --- /dev/null +++ b/queue-6.1/net-iucv-fix-the-allocation-size-of-iucv_path_table-.patch @@ -0,0 +1,46 @@ +From 1090b6842a3492659cdc5e4defa89c56b66087ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 17:32:40 +0100 +Subject: net/iucv: fix the allocation size of iucv_path_table array + +From: Alexander Gordeev + +[ Upstream commit b4ea9b6a18ebf7f9f3a7a60f82e925186978cfcf ] + +iucv_path_table is a dynamically allocated array of pointers to +struct iucv_path items. Yet, its size is calculated as if it was +an array of struct iucv_path items. + +Signed-off-by: Alexander Gordeev +Reviewed-by: Alexandra Winter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/iucv/iucv.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c +index fc3fddeb6f36d..f66b5f74cd83a 100644 +--- a/net/iucv/iucv.c ++++ b/net/iucv/iucv.c +@@ -156,7 +156,7 @@ static char iucv_error_pathid[16] = "INVALID PATHID"; + static LIST_HEAD(iucv_handler_list); + + /* +- * iucv_path_table: an array of iucv_path structures. ++ * iucv_path_table: array of pointers to iucv_path structures. + */ + static struct iucv_path **iucv_path_table; + static unsigned long iucv_max_pathid; +@@ -544,7 +544,7 @@ static int iucv_enable(void) + + cpus_read_lock(); + rc = -ENOMEM; +- alloc_size = iucv_max_pathid * sizeof(struct iucv_path); ++ alloc_size = iucv_max_pathid * sizeof(*iucv_path_table); + iucv_path_table = kzalloc(alloc_size, GFP_KERNEL); + if (!iucv_path_table) + goto out; +-- +2.43.0 + diff --git a/queue-6.1/net-smsc95xx-add-support-for-sys-tec-usb-spemodule1.patch b/queue-6.1/net-smsc95xx-add-support-for-sys-tec-usb-spemodule1.patch new file mode 100644 index 00000000000..eaf0fdcb093 --- /dev/null +++ b/queue-6.1/net-smsc95xx-add-support-for-sys-tec-usb-spemodule1.patch @@ -0,0 +1,40 @@ +From 564891c3a66034a851008b0fc7150c6e81bcac60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 06:33:32 +0100 +Subject: net: smsc95xx: add support for SYS TEC USB-SPEmodule1 + +From: Andre Werner + +[ Upstream commit 45532b21dc2a692444b6ad5f71c253cca53e8103 ] + +This patch adds support for the SYS TEC USB-SPEmodule1 10Base-T1L +ethernet device to the existing smsc95xx driver by adding the new +USB VID/PID pair. + +Signed-off-by: Andre Werner +Link: https://lore.kernel.org/r/20240219053413.4732-1-andre.werner@systec-electronic.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/smsc95xx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index a530f20ee2575..2fa46baa589e5 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -2104,6 +2104,11 @@ static const struct usb_device_id products[] = { + USB_DEVICE(0x0424, 0x9E08), + .driver_info = (unsigned long) &smsc95xx_info, + }, ++ { ++ /* SYSTEC USB-SPEmodule1 10BASE-T1L Ethernet Device */ ++ USB_DEVICE(0x0878, 0x1400), ++ .driver_info = (unsigned long)&smsc95xx_info, ++ }, + { + /* Microchip's EVB-LAN8670-USB 10BASE-T1S Ethernet Device */ + USB_DEVICE(0x184F, 0x0051), +-- +2.43.0 + diff --git a/queue-6.1/parisc-ftrace-add-missing-config_dynamic_ftrace-chec.patch b/queue-6.1/parisc-ftrace-add-missing-config_dynamic_ftrace-chec.patch new file mode 100644 index 00000000000..2f71cc6dca9 --- /dev/null +++ b/queue-6.1/parisc-ftrace-add-missing-config_dynamic_ftrace-chec.patch @@ -0,0 +1,42 @@ +From 64d7bac6b4731a7f58e9105f16b5f07a4e8336c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Feb 2024 23:43:14 +0100 +Subject: parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check + +From: Max Kellermann + +[ Upstream commit 250f5402e636a5cec9e0e95df252c3d54307210f ] + +Fixes a bug revealed by -Wmissing-prototypes when +CONFIG_FUNCTION_GRAPH_TRACER is enabled but not CONFIG_DYNAMIC_FTRACE: + + arch/parisc/kernel/ftrace.c:82:5: error: no previous prototype for 'ftrace_enable_ftrace_graph_caller' [-Werror=missing-prototypes] + 82 | int ftrace_enable_ftrace_graph_caller(void) + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + arch/parisc/kernel/ftrace.c:88:5: error: no previous prototype for 'ftrace_disable_ftrace_graph_caller' [-Werror=missing-prototypes] + 88 | int ftrace_disable_ftrace_graph_caller(void) + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Signed-off-by: Max Kellermann +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/ftrace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/parisc/kernel/ftrace.c b/arch/parisc/kernel/ftrace.c +index 4d392e4ed3584..ac7253891d5ed 100644 +--- a/arch/parisc/kernel/ftrace.c ++++ b/arch/parisc/kernel/ftrace.c +@@ -78,7 +78,7 @@ void notrace __hot ftrace_function_trampoline(unsigned long parent, + #endif + } + +-#ifdef CONFIG_FUNCTION_GRAPH_TRACER ++#if defined(CONFIG_DYNAMIC_FTRACE) && defined(CONFIG_FUNCTION_GRAPH_TRACER) + int ftrace_enable_ftrace_graph_caller(void) + { + static_key_enable(&ftrace_graph_enable.key); +-- +2.43.0 + diff --git a/queue-6.1/perf-arm-cmn-workaround-ampereonex-errata-ac04_mesh_.patch b/queue-6.1/perf-arm-cmn-workaround-ampereonex-errata-ac04_mesh_.patch new file mode 100644 index 00000000000..265dcb789ee --- /dev/null +++ b/queue-6.1/perf-arm-cmn-workaround-ampereonex-errata-ac04_mesh_.patch @@ -0,0 +1,54 @@ +From 9fcaca53ab17f102e1774d9f698520f967473e28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Feb 2024 17:11:09 +0000 +Subject: perf/arm-cmn: Workaround AmpereOneX errata AC04_MESH_1 (incorrect + child count) + +From: Ilkka Koskinen + +[ Upstream commit 50572064ec7109b00eef8880e905f55861c8b3de ] + +AmpereOneX mesh implementation has a bug in HN-P nodes that makes them +report incorrect child count. The failing crosspoints report 8 children +while they only have two. + +When the driver tries to access the inexistent child nodes, it believes it +has reached an invalid node type and probing fails. The workaround is to +ignore those incorrect child nodes and continue normally. + +Signed-off-by: Ilkka Koskinen +[ rm: rewrote simpler generalised version ] +Tested-by: Ilkka Koskinen +Signed-off-by: Robin Murphy +Link: https://lore.kernel.org/r/ce4b1442135fe03d0de41859b04b268c88c854a3.1707498577.git.robin.murphy@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm-cmn.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c +index 47e7c3206939f..899e4ed49905c 100644 +--- a/drivers/perf/arm-cmn.c ++++ b/drivers/perf/arm-cmn.c +@@ -2178,6 +2178,17 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset) + dev_dbg(cmn->dev, "ignoring external node %llx\n", reg); + continue; + } ++ /* ++ * AmpereOneX erratum AC04_MESH_1 makes some XPs report a bogus ++ * child count larger than the number of valid child pointers. ++ * A child offset of 0 can only occur on CMN-600; otherwise it ++ * would imply the root node being its own grandchild, which ++ * we can safely dismiss in general. ++ */ ++ if (reg == 0 && cmn->part != PART_CMN600) { ++ dev_dbg(cmn->dev, "bogus child pointer?\n"); ++ continue; ++ } + + arm_cmn_init_node_info(cmn, reg & CMN_CHILD_NODE_ADDR, dn); + +-- +2.43.0 + diff --git a/queue-6.1/rdma-mlx5-fix-fortify-source-warning-while-accessing.patch b/queue-6.1/rdma-mlx5-fix-fortify-source-warning-while-accessing.patch new file mode 100644 index 00000000000..ce188e2bf99 --- /dev/null +++ b/queue-6.1/rdma-mlx5-fix-fortify-source-warning-while-accessing.patch @@ -0,0 +1,131 @@ +From dfae085cacdc1ff52b0bc255cdb42f2754f6cfd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jan 2024 11:29:11 +0200 +Subject: RDMA/mlx5: Fix fortify source warning while accessing Eth segment + +From: Leon Romanovsky + +[ Upstream commit 4d5e86a56615cc387d21c629f9af8fb0e958d350 ] + + ------------[ cut here ]------------ + memcpy: detected field-spanning write (size 56) of single field "eseg->inline_hdr.start" at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 (size 2) + WARNING: CPU: 0 PID: 293779 at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] + Modules linked in: 8021q garp mrp stp llc rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) ib_uverbs(OE) ib_core(OE) mlx5_core(OE) pci_hyperv_intf mlxdevm(OE) mlx_compat(OE) tls mlxfw(OE) psample nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink mst_pciconf(OE) knem(OE) vfio_pci vfio_pci_core vfio_iommu_type1 vfio iommufd irqbypass cuse nfsv3 nfs fscache netfs xfrm_user xfrm_algo ipmi_devintf ipmi_msghandler binfmt_misc crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel sha512_ssse3 snd_pcsp aesni_intel crypto_simd cryptd snd_pcm snd_timer joydev snd soundcore input_leds serio_raw evbug nfsd auth_rpcgss nfs_acl lockd grace sch_fq_codel sunrpc drm efi_pstore ip_tables x_tables autofs4 psmouse virtio_net net_failover failover floppy + [last unloaded: mlx_compat(OE)] + CPU: 0 PID: 293779 Comm: ssh Tainted: G OE 6.2.0-32-generic #32~22.04.1-Ubuntu + Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 + RIP: 0010:mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] + Code: 0c 01 00 a8 01 75 25 48 8b 75 a0 b9 02 00 00 00 48 c7 c2 10 5b fd c0 48 c7 c7 80 5b fd c0 c6 05 57 0c 03 00 01 e8 95 4d 93 da <0f> 0b 44 8b 4d b0 4c 8b 45 c8 48 8b 4d c0 e9 49 fb ff ff 41 0f b7 + RSP: 0018:ffffb5b48478b570 EFLAGS: 00010046 + RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 + RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 + RBP: ffffb5b48478b628 R08: 0000000000000000 R09: 0000000000000000 + R10: 0000000000000000 R11: 0000000000000000 R12: ffffb5b48478b5e8 + R13: ffff963a3c609b5e R14: ffff9639c3fbd800 R15: ffffb5b480475a80 + FS: 00007fc03b444c80(0000) GS:ffff963a3dc00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000556f46bdf000 CR3: 0000000006ac6003 CR4: 00000000003706f0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + + ? show_regs+0x72/0x90 + ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] + ? __warn+0x8d/0x160 + ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] + ? report_bug+0x1bb/0x1d0 + ? handle_bug+0x46/0x90 + ? exc_invalid_op+0x19/0x80 + ? asm_exc_invalid_op+0x1b/0x20 + ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] + mlx5_ib_post_send_nodrain+0xb/0x20 [mlx5_ib] + ipoib_send+0x2ec/0x770 [ib_ipoib] + ipoib_start_xmit+0x5a0/0x770 [ib_ipoib] + dev_hard_start_xmit+0x8e/0x1e0 + ? validate_xmit_skb_list+0x4d/0x80 + sch_direct_xmit+0x116/0x3a0 + __dev_xmit_skb+0x1fd/0x580 + __dev_queue_xmit+0x284/0x6b0 + ? _raw_spin_unlock_irq+0xe/0x50 + ? __flush_work.isra.0+0x20d/0x370 + ? push_pseudo_header+0x17/0x40 [ib_ipoib] + neigh_connected_output+0xcd/0x110 + ip_finish_output2+0x179/0x480 + ? __smp_call_single_queue+0x61/0xa0 + __ip_finish_output+0xc3/0x190 + ip_finish_output+0x2e/0xf0 + ip_output+0x78/0x110 + ? __pfx_ip_finish_output+0x10/0x10 + ip_local_out+0x64/0x70 + __ip_queue_xmit+0x18a/0x460 + ip_queue_xmit+0x15/0x30 + __tcp_transmit_skb+0x914/0x9c0 + tcp_write_xmit+0x334/0x8d0 + tcp_push_one+0x3c/0x60 + tcp_sendmsg_locked+0x2e1/0xac0 + tcp_sendmsg+0x2d/0x50 + inet_sendmsg+0x43/0x90 + sock_sendmsg+0x68/0x80 + sock_write_iter+0x93/0x100 + vfs_write+0x326/0x3c0 + ksys_write+0xbd/0xf0 + ? do_syscall_64+0x69/0x90 + __x64_sys_write+0x19/0x30 + do_syscall_64+0x59/0x90 + ? do_user_addr_fault+0x1d0/0x640 + ? exit_to_user_mode_prepare+0x3b/0xd0 + ? irqentry_exit_to_user_mode+0x9/0x20 + ? irqentry_exit+0x43/0x50 + ? exc_page_fault+0x92/0x1b0 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + RIP: 0033:0x7fc03ad14a37 + Code: 10 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 + RSP: 002b:00007ffdf8697fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 + RAX: ffffffffffffffda RBX: 0000000000008024 RCX: 00007fc03ad14a37 + RDX: 0000000000008024 RSI: 0000556f46bd8270 RDI: 0000000000000003 + RBP: 0000556f46bb1800 R08: 0000000000007fe3 R09: 0000000000000000 + R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 + R13: 0000556f46bc66b0 R14: 000000000000000a R15: 0000556f46bb2f50 + + ---[ end trace 0000000000000000 ]--- + +Link: https://lore.kernel.org/r/8228ad34bd1a25047586270f7b1fb4ddcd046282.1706433934.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/wr.c | 2 +- + include/linux/mlx5/qp.h | 5 ++++- + 2 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/wr.c b/drivers/infiniband/hw/mlx5/wr.c +index 855f3f4fefadd..737db67a9ce1d 100644 +--- a/drivers/infiniband/hw/mlx5/wr.c ++++ b/drivers/infiniband/hw/mlx5/wr.c +@@ -78,7 +78,7 @@ static void set_eth_seg(const struct ib_send_wr *wr, struct mlx5_ib_qp *qp, + */ + copysz = min_t(u64, *cur_edge - (void *)eseg->inline_hdr.start, + left); +- memcpy(eseg->inline_hdr.start, pdata, copysz); ++ memcpy(eseg->inline_hdr.data, pdata, copysz); + stride = ALIGN(sizeof(struct mlx5_wqe_eth_seg) - + sizeof(eseg->inline_hdr.start) + copysz, 16); + *size += stride / 16; +diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h +index 4657d5c54abef..ca0eee571ad7b 100644 +--- a/include/linux/mlx5/qp.h ++++ b/include/linux/mlx5/qp.h +@@ -269,7 +269,10 @@ struct mlx5_wqe_eth_seg { + union { + struct { + __be16 sz; +- u8 start[2]; ++ union { ++ u8 start[2]; ++ DECLARE_FLEX_ARRAY(u8, data); ++ }; + } inline_hdr; + struct { + __be16 type; +-- +2.43.0 + diff --git a/queue-6.1/rdma-mlx5-relax-devx-access-upon-modify-commands.patch b/queue-6.1/rdma-mlx5-relax-devx-access-upon-modify-commands.patch new file mode 100644 index 00000000000..64b19a89218 --- /dev/null +++ b/queue-6.1/rdma-mlx5-relax-devx-access-upon-modify-commands.patch @@ -0,0 +1,47 @@ +From b686156c31aaa201e610892738f159671ed4e926 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jan 2024 11:29:13 +0200 +Subject: RDMA/mlx5: Relax DEVX access upon modify commands + +From: Yishai Hadas + +[ Upstream commit be551ee1574280ef8afbf7c271212ac3e38933ef ] + +Relax DEVX access upon modify commands to be UVERBS_ACCESS_READ. + +The kernel doesn't need to protect what firmware protects, or what +causes no damage to anyone but the user. + +As firmware needs to protect itself from parallel access to the same +object, don't block parallel modify/query commands on the same object in +the kernel side. + +This change will allow user space application to run parallel updates to +different entries in the same bulk object. + +Tested-by: Tamar Mashiah +Signed-off-by: Yishai Hadas +Reviewed-by: Michael Guralnik +Link: https://lore.kernel.org/r/7407d5ed35dc427c1097699e12b49c01e1073406.1706433934.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/devx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c +index f8e2baed27a5c..7013ce20549bd 100644 +--- a/drivers/infiniband/hw/mlx5/devx.c ++++ b/drivers/infiniband/hw/mlx5/devx.c +@@ -2951,7 +2951,7 @@ DECLARE_UVERBS_NAMED_METHOD( + MLX5_IB_METHOD_DEVX_OBJ_MODIFY, + UVERBS_ATTR_IDR(MLX5_IB_ATTR_DEVX_OBJ_MODIFY_HANDLE, + UVERBS_IDR_ANY_OBJECT, +- UVERBS_ACCESS_WRITE, ++ UVERBS_ACCESS_READ, + UA_MANDATORY), + UVERBS_ATTR_PTR_IN( + MLX5_IB_ATTR_DEVX_OBJ_MODIFY_CMD_IN, +-- +2.43.0 + diff --git a/queue-6.1/riscv-dts-sifive-add-missing-interrupt-cells-to-pmic.patch b/queue-6.1/riscv-dts-sifive-add-missing-interrupt-cells-to-pmic.patch new file mode 100644 index 00000000000..1bc09a53beb --- /dev/null +++ b/queue-6.1/riscv-dts-sifive-add-missing-interrupt-cells-to-pmic.patch @@ -0,0 +1,36 @@ +From 1874aa1b74c29b7a9152170d1f04a7bd11c4b0a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 19:45:40 +0000 +Subject: riscv: dts: sifive: add missing #interrupt-cells to pmic + +From: Conor Dooley + +[ Upstream commit ce6b6d1513965f500a05f3facf223fa01fd74920 ] + +At W=2 dtc complains: +hifive-unmatched-a00.dts:120.10-238.4: Warning (interrupt_provider): /soc/i2c@10030000/pmic@58: Missing '#interrupt-cells' in interrupt provider + +Add the missing property. + +Reviewed-by: Samuel Holland +Signed-off-by: Conor Dooley +Signed-off-by: Sasha Levin +--- + arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts b/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts +index 07387f9c135ca..72b87b08ab444 100644 +--- a/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts ++++ b/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts +@@ -123,6 +123,7 @@ pmic@58 { + interrupt-parent = <&gpio>; + interrupts = <1 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + + onkey { + compatible = "dlg,da9063-onkey"; +-- +2.43.0 + diff --git a/queue-6.1/scsi-mpt3sas-prevent-sending-diag_reset-when-the-con.patch b/queue-6.1/scsi-mpt3sas-prevent-sending-diag_reset-when-the-con.patch new file mode 100644 index 00000000000..5ca2508a2ac --- /dev/null +++ b/queue-6.1/scsi-mpt3sas-prevent-sending-diag_reset-when-the-con.patch @@ -0,0 +1,44 @@ +From 8a095eb3ae1b9a66b87702988b9777bcfb07f15a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Feb 2024 12:47:24 +0530 +Subject: scsi: mpt3sas: Prevent sending diag_reset when the controller is + ready + +From: Ranjan Kumar + +[ Upstream commit ee0017c3ed8a8abfa4d40e42f908fb38c31e7515 ] + +If the driver detects that the controller is not ready before sending the +first IOC facts command, it will wait for a maximum of 10 seconds for it to +become ready. However, even if the controller becomes ready within 10 +seconds, the driver will still issue a diagnostic reset. + +Modify the driver to avoid sending a diag reset if the controller becomes +ready within the 10-second wait time. + +Signed-off-by: Ranjan Kumar +Link: https://lore.kernel.org/r/20240221071724.14986-1-ranjan.kumar@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 809be43f440dc..8e6ac08e553bb 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -7398,7 +7398,9 @@ _base_wait_for_iocstate(struct MPT3SAS_ADAPTER *ioc, int timeout) + return -EFAULT; + } + +- issue_diag_reset: ++ return 0; ++ ++issue_diag_reset: + rc = _base_diag_reset(ioc); + return rc; + } +-- +2.43.0 + diff --git a/queue-6.1/selftests-tls-use-exact-comparison-in-recv_partial.patch b/queue-6.1/selftests-tls-use-exact-comparison-in-recv_partial.patch new file mode 100644 index 00000000000..e61894cba68 --- /dev/null +++ b/queue-6.1/selftests-tls-use-exact-comparison-in-recv_partial.patch @@ -0,0 +1,44 @@ +From bfe73c92bb088645dbf96b3a78b4834ed032147b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 17:18:23 -0800 +Subject: selftests: tls: use exact comparison in recv_partial + +From: Jakub Kicinski + +[ Upstream commit 49d821064c44cb5ffdf272905236012ea9ce50e3 ] + +This exact case was fail for async crypto and we weren't +catching it. + +Signed-off-by: Jakub Kicinski +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/tls.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/net/tls.c b/tools/testing/selftests/net/tls.c +index 5b80fb155d549..d89ee6e1926c7 100644 +--- a/tools/testing/selftests/net/tls.c ++++ b/tools/testing/selftests/net/tls.c +@@ -926,12 +926,12 @@ TEST_F(tls, recv_partial) + + memset(recv_mem, 0, sizeof(recv_mem)); + EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len); +- EXPECT_NE(recv(self->cfd, recv_mem, strlen(test_str_first), +- MSG_WAITALL), -1); ++ EXPECT_EQ(recv(self->cfd, recv_mem, strlen(test_str_first), ++ MSG_WAITALL), strlen(test_str_first)); + EXPECT_EQ(memcmp(test_str_first, recv_mem, strlen(test_str_first)), 0); + memset(recv_mem, 0, sizeof(recv_mem)); +- EXPECT_NE(recv(self->cfd, recv_mem, strlen(test_str_second), +- MSG_WAITALL), -1); ++ EXPECT_EQ(recv(self->cfd, recv_mem, strlen(test_str_second), ++ MSG_WAITALL), strlen(test_str_second)); + EXPECT_EQ(memcmp(test_str_second, recv_mem, strlen(test_str_second)), + 0); + } +-- +2.43.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 109865ba4d5..1ecabec4dfb 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -16,3 +16,42 @@ nfsd-simplify-the-delayed-disposal-list-code.patch nfsd-fix-problem-of-commit-and-nfs4err_delay-in-infi.patch nfsd-add-an-nfsd4_encode_nfstime4-helper.patch nfsd-fix-creation-time-serialization-order.patch +media-rkisp1-fix-irq-handling-due-to-shared-interrup.patch +perf-arm-cmn-workaround-ampereonex-errata-ac04_mesh_.patch +selftests-tls-use-exact-comparison-in-recv_partial.patch +asoc-rt5645-make-lattepanda-board-dmi-match-more-pre.patch +asoc-amd-yc-fix-non-functional-mic-on-lenovo-82uu.patch +x86-xen-add-some-null-pointer-checking-to-smp.c.patch +mips-clear-cause.bd-in-instruction_pointer_set.patch +hid-multitouch-add-required-quirk-for-synaptics-0xcd.patch +gen_compile_commands-fix-invalid-escape-sequence-war.patch +arm64-sve-lower-the-maximum-allocation-for-the-sve-p.patch +soc-microchip-fix-polarfire_soc_sys_ctrl-input-promp.patch +rdma-mlx5-fix-fortify-source-warning-while-accessing.patch +rdma-mlx5-relax-devx-access-upon-modify-commands.patch +riscv-dts-sifive-add-missing-interrupt-cells-to-pmic.patch +x86-mm-move-is_vsyscall_vaddr-into-asm-vsyscall.h.patch +x86-mm-disallow-vsyscall-page-read-for-copy_from_ker.patch +net-iucv-fix-the-allocation-size-of-iucv_path_table-.patch +parisc-ftrace-add-missing-config_dynamic_ftrace-chec.patch +block-sed-opal-handle-empty-atoms-when-parsing-respo.patch +dm-verity-dm-crypt-align-struct-bvec_iter-correctly.patch +arm64-dts-fix-dtc-interrupt_provider-warnings.patch +btrfs-fix-data-races-when-accessing-the-reserved-amo.patch +btrfs-fix-data-race-at-btrfs_use_block_rsv-when-acce.patch +net-smsc95xx-add-support-for-sys-tec-usb-spemodule1.patch +wifi-mac80211-only-call-drv_sta_rc_update-for-upload.patch +asoc-amd-yc-add-lenovo-thinkbook-21j0-into-dmi-quirk.patch +scsi-mpt3sas-prevent-sending-diag_reset-when-the-con.patch +alsa-hda-realtek-alc285-reduce-pop-noise-from-headph.patch +drm-amdgpu-enable-gpu-reset-for-s3-abort-cases-on-ra.patch +asoc-amd-yc-fix-non-functional-mic-on-lenovo-21j2.patch +bluetooth-rfcomm-fix-null-ptr-deref-in-rfcomm_check_.patch +bluetooth-mgmt-fix-limited-discoverable-off-timeout.patch +firewire-core-use-long-bus-reset-on-gap-count-error.patch +arm64-tegra-set-the-correct-phy-mode-for-mgbe.patch +asoc-intel-bytcr_rt5640-add-an-extra-entry-for-the-c.patch +input-gpio_keys_polled-suppress-deferred-probe-error.patch +asoc-wm8962-enable-oscillator-if-selecting-wm8962_fl.patch +asoc-wm8962-enable-both-spkoutr_ena-and-spkoutl_ena-.patch +asoc-wm8962-fix-up-incorrect-error-message-in-wm8962.patch diff --git a/queue-6.1/soc-microchip-fix-polarfire_soc_sys_ctrl-input-promp.patch b/queue-6.1/soc-microchip-fix-polarfire_soc_sys_ctrl-input-promp.patch new file mode 100644 index 00000000000..b2a4dec4eeb --- /dev/null +++ b/queue-6.1/soc-microchip-fix-polarfire_soc_sys_ctrl-input-promp.patch @@ -0,0 +1,33 @@ +From b916a1a60b649dcd1b9823f8fb829a35de980e93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 16:04:14 +0100 +Subject: soc: microchip: Fix POLARFIRE_SOC_SYS_CTRL input prompt + +From: Geert Uytterhoeven + +[ Upstream commit 6dd9a236042e305d7b69ee92db7347bf5943e7d3 ] + +The symbol's prompt should be a one-line description, instead of just +duplicating the symbol name. + +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Conor Dooley +Signed-off-by: Sasha Levin +--- + drivers/soc/microchip/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/microchip/Kconfig b/drivers/soc/microchip/Kconfig +index eb656b33156ba..f19e74d342aa2 100644 +--- a/drivers/soc/microchip/Kconfig ++++ b/drivers/soc/microchip/Kconfig +@@ -1,5 +1,5 @@ + config POLARFIRE_SOC_SYS_CTRL +- tristate "POLARFIRE_SOC_SYS_CTRL" ++ tristate "Microchip PolarFire SoC (MPFS) system controller support" + depends on POLARFIRE_SOC_MAILBOX + help + This driver adds support for the PolarFire SoC (MPFS) system controller. +-- +2.43.0 + diff --git a/queue-6.1/wifi-mac80211-only-call-drv_sta_rc_update-for-upload.patch b/queue-6.1/wifi-mac80211-only-call-drv_sta_rc_update-for-upload.patch new file mode 100644 index 00000000000..b74b08ed44d --- /dev/null +++ b/queue-6.1/wifi-mac80211-only-call-drv_sta_rc_update-for-upload.patch @@ -0,0 +1,39 @@ +From 57b3eb45a9f60316e72b7fb0b7632ecfd4f57518 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Feb 2024 15:05:35 +0100 +Subject: wifi: mac80211: only call drv_sta_rc_update for uploaded stations + +From: Felix Fietkau + +[ Upstream commit 413dafc8170fcb925fb17af8842f06af305f8e0b ] + +When a station has not been uploaded yet, receiving SMPS or channel width +notification action frames can lead to rate_control_rate_update calling +drv_sta_rc_update with uninitialized driver private data. +Fix this by adding a missing check for sta->uploaded. + +Signed-off-by: Felix Fietkau +Link: https://msgid.link/20240221140535.16102-1-nbd@nbd.name +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rate.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c +index d5ea5f5bcf3a0..9d33fd2377c88 100644 +--- a/net/mac80211/rate.c ++++ b/net/mac80211/rate.c +@@ -119,7 +119,8 @@ void rate_control_rate_update(struct ieee80211_local *local, + rcu_read_unlock(); + } + +- drv_sta_rc_update(local, sta->sdata, &sta->sta, changed); ++ if (sta->uploaded) ++ drv_sta_rc_update(local, sta->sdata, &sta->sta, changed); + } + + int ieee80211_rate_control_register(const struct rate_control_ops *ops) +-- +2.43.0 + diff --git a/queue-6.1/x86-mm-disallow-vsyscall-page-read-for-copy_from_ker.patch b/queue-6.1/x86-mm-disallow-vsyscall-page-read-for-copy_from_ker.patch new file mode 100644 index 00000000000..351cf1aef56 --- /dev/null +++ b/queue-6.1/x86-mm-disallow-vsyscall-page-read-for-copy_from_ker.patch @@ -0,0 +1,100 @@ +From db260111f48563b75fdc7f04021df1dafd794375 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 18:39:34 +0800 +Subject: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() + +From: Hou Tao + +[ Upstream commit 32019c659ecfe1d92e3bf9fcdfbb11a7c70acd58 ] + +When trying to use copy_from_kernel_nofault() to read vsyscall page +through a bpf program, the following oops was reported: + + BUG: unable to handle page fault for address: ffffffffff600000 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 3231067 P4D 3231067 PUD 3233067 PMD 3235067 PTE 0 + Oops: 0000 [#1] PREEMPT SMP PTI + CPU: 1 PID: 20390 Comm: test_progs ...... 6.7.0+ #58 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... + RIP: 0010:copy_from_kernel_nofault+0x6f/0x110 + ...... + Call Trace: + + ? copy_from_kernel_nofault+0x6f/0x110 + bpf_probe_read_kernel+0x1d/0x50 + bpf_prog_2061065e56845f08_do_probe_read+0x51/0x8d + trace_call_bpf+0xc5/0x1c0 + perf_call_bpf_enter.isra.0+0x69/0xb0 + perf_syscall_enter+0x13e/0x200 + syscall_trace_enter+0x188/0x1c0 + do_syscall_64+0xb5/0xe0 + entry_SYSCALL_64_after_hwframe+0x6e/0x76 + + ...... + ---[ end trace 0000000000000000 ]--- + +The oops is triggered when: + +1) A bpf program uses bpf_probe_read_kernel() to read from the vsyscall +page and invokes copy_from_kernel_nofault() which in turn calls +__get_user_asm(). + +2) Because the vsyscall page address is not readable from kernel space, +a page fault exception is triggered accordingly. + +3) handle_page_fault() considers the vsyscall page address as a user +space address instead of a kernel space address. This results in the +fix-up setup by bpf not being applied and a page_fault_oops() is invoked +due to SMAP. + +Considering handle_page_fault() has already considered the vsyscall page +address as a userspace address, fix the problem by disallowing vsyscall +page read for copy_from_kernel_nofault(). + +Originally-by: Thomas Gleixner +Reported-by: syzbot+72aa0161922eba61b50e@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/bpf/CAG48ez06TZft=ATH1qh2c5mpS5BT8UakwNkzi6nvK5_djC-4Nw@mail.gmail.com +Reported-by: xingwei lee +Closes: https://lore.kernel.org/bpf/CABOYnLynjBoFZOf3Z4BhaZkc5hx_kHfsjiW+UWLoB=w33LvScw@mail.gmail.com +Signed-off-by: Hou Tao +Reviewed-by: Sohil Mehta +Acked-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20240202103935.3154011-3-houtao@huaweicloud.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/x86/mm/maccess.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/arch/x86/mm/maccess.c b/arch/x86/mm/maccess.c +index 6993f026adec9..42115ac079cfe 100644 +--- a/arch/x86/mm/maccess.c ++++ b/arch/x86/mm/maccess.c +@@ -3,6 +3,8 @@ + #include + #include + ++#include ++ + #ifdef CONFIG_X86_64 + bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size) + { +@@ -15,6 +17,14 @@ bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size) + if (vaddr < TASK_SIZE_MAX + PAGE_SIZE) + return false; + ++ /* ++ * Reading from the vsyscall page may cause an unhandled fault in ++ * certain cases. Though it is at an address above TASK_SIZE_MAX, it is ++ * usually considered as a user space address. ++ */ ++ if (is_vsyscall_vaddr(vaddr)) ++ return false; ++ + /* + * Allow everything during early boot before 'x86_virt_bits' + * is initialized. Needed for instruction decoding in early +-- +2.43.0 + diff --git a/queue-6.1/x86-mm-move-is_vsyscall_vaddr-into-asm-vsyscall.h.patch b/queue-6.1/x86-mm-move-is_vsyscall_vaddr-into-asm-vsyscall.h.patch new file mode 100644 index 00000000000..94d952eb04d --- /dev/null +++ b/queue-6.1/x86-mm-move-is_vsyscall_vaddr-into-asm-vsyscall.h.patch @@ -0,0 +1,71 @@ +From 36af2302156b1fbd02cee68775b951264c8ad1f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 18:39:33 +0800 +Subject: x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h + +From: Hou Tao + +[ Upstream commit ee0e39a63b78849f8abbef268b13e4838569f646 ] + +Move is_vsyscall_vaddr() into asm/vsyscall.h to make it available for +copy_from_kernel_nofault_allowed() in arch/x86/mm/maccess.c. + +Reviewed-by: Sohil Mehta +Signed-off-by: Hou Tao +Link: https://lore.kernel.org/r/20240202103935.3154011-2-houtao@huaweicloud.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/vsyscall.h | 10 ++++++++++ + arch/x86/mm/fault.c | 9 --------- + 2 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/arch/x86/include/asm/vsyscall.h b/arch/x86/include/asm/vsyscall.h +index ab60a71a8dcb9..472f0263dbc61 100644 +--- a/arch/x86/include/asm/vsyscall.h ++++ b/arch/x86/include/asm/vsyscall.h +@@ -4,6 +4,7 @@ + + #include + #include ++#include + + #ifdef CONFIG_X86_VSYSCALL_EMULATION + extern void map_vsyscall(void); +@@ -24,4 +25,13 @@ static inline bool emulate_vsyscall(unsigned long error_code, + } + #endif + ++/* ++ * The (legacy) vsyscall page is the long page in the kernel portion ++ * of the address space that has user-accessible permissions. ++ */ ++static inline bool is_vsyscall_vaddr(unsigned long vaddr) ++{ ++ return unlikely((vaddr & PAGE_MASK) == VSYSCALL_ADDR); ++} ++ + #endif /* _ASM_X86_VSYSCALL_H */ +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index 1dbbad73192a1..f20636510eb1e 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -818,15 +818,6 @@ show_signal_msg(struct pt_regs *regs, unsigned long error_code, + show_opcodes(regs, loglvl); + } + +-/* +- * The (legacy) vsyscall page is the long page in the kernel portion +- * of the address space that has user-accessible permissions. +- */ +-static bool is_vsyscall_vaddr(unsigned long vaddr) +-{ +- return unlikely((vaddr & PAGE_MASK) == VSYSCALL_ADDR); +-} +- + static void + __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code, + unsigned long address, u32 pkey, int si_code) +-- +2.43.0 + diff --git a/queue-6.1/x86-xen-add-some-null-pointer-checking-to-smp.c.patch b/queue-6.1/x86-xen-add-some-null-pointer-checking-to-smp.c.patch new file mode 100644 index 00000000000..18b8c8ee5e9 --- /dev/null +++ b/queue-6.1/x86-xen-add-some-null-pointer-checking-to-smp.c.patch @@ -0,0 +1,79 @@ +From a571b2b7c7ead96f4b05bcd311782c595da377bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 17:49:48 +0800 +Subject: x86/xen: Add some null pointer checking to smp.c + +From: Kunwu Chan + +[ Upstream commit 3693bb4465e6e32a204a5b86d3ec7e6b9f7e67c2 ] + +kasprintf() returns a pointer to dynamically allocated memory +which can be NULL upon failure. Ensure the allocation was successful +by checking the pointer validity. + +Signed-off-by: Kunwu Chan +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202401161119.iof6BQsf-lkp@intel.com/ +Suggested-by: Markus Elfring +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20240119094948.275390-1-chentao@kylinos.cn +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + arch/x86/xen/smp.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c +index 4b0d6fff88de5..1fb9a1644d944 100644 +--- a/arch/x86/xen/smp.c ++++ b/arch/x86/xen/smp.c +@@ -65,6 +65,8 @@ int xen_smp_intr_init(unsigned int cpu) + char *resched_name, *callfunc_name, *debug_name; + + resched_name = kasprintf(GFP_KERNEL, "resched%d", cpu); ++ if (!resched_name) ++ goto fail_mem; + per_cpu(xen_resched_irq, cpu).name = resched_name; + rc = bind_ipi_to_irqhandler(XEN_RESCHEDULE_VECTOR, + cpu, +@@ -77,6 +79,8 @@ int xen_smp_intr_init(unsigned int cpu) + per_cpu(xen_resched_irq, cpu).irq = rc; + + callfunc_name = kasprintf(GFP_KERNEL, "callfunc%d", cpu); ++ if (!callfunc_name) ++ goto fail_mem; + per_cpu(xen_callfunc_irq, cpu).name = callfunc_name; + rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_VECTOR, + cpu, +@@ -90,6 +94,9 @@ int xen_smp_intr_init(unsigned int cpu) + + if (!xen_fifo_events) { + debug_name = kasprintf(GFP_KERNEL, "debug%d", cpu); ++ if (!debug_name) ++ goto fail_mem; ++ + per_cpu(xen_debug_irq, cpu).name = debug_name; + rc = bind_virq_to_irqhandler(VIRQ_DEBUG, cpu, + xen_debug_interrupt, +@@ -101,6 +108,9 @@ int xen_smp_intr_init(unsigned int cpu) + } + + callfunc_name = kasprintf(GFP_KERNEL, "callfuncsingle%d", cpu); ++ if (!callfunc_name) ++ goto fail_mem; ++ + per_cpu(xen_callfuncsingle_irq, cpu).name = callfunc_name; + rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_SINGLE_VECTOR, + cpu, +@@ -114,6 +124,8 @@ int xen_smp_intr_init(unsigned int cpu) + + return 0; + ++ fail_mem: ++ rc = -ENOMEM; + fail: + xen_smp_intr_free(cpu); + return rc; +-- +2.43.0 + -- 2.47.3